1. Persistence Maintaining state: Queries

2. State is the Problem What is state? facebook status logins (which user are you?) conversations talking about what? talking to whom?

3. HTTP Protocol stateless protocol by design! (why TCP?) The server does not know what you did What website you were on What you just did on the website Who you are page to page Each page is independent of the other!

4. Why do you care? Maintain items in a shopping cart Website User Accounts Web Apps using more than ONE page Allow bookmarks of query results Polling, Statistics, Advertising

5. Security Queries are not secure Cookies are not secure Easily accessible and editable TEXT! Cookies can be set secure - browser will only sent over HTTPS NOT that safe

6. Solution ONLY store session IDs or account name This means the cookie is a token SSL secure the connection: Session IDs can't be ripped off the net *Client man-in-the-middle attacks *Expire sessions + make new ones

7. URL Query Old school way to maintain state http://search.com?search=http://search.com?search=cars&account=john Old school way to maintain state http://search.com?search=http://search.com?search=cars&account=john

8. Query strings URL(Uniform Resource Locator) / URI Delineator characters: ? & = location (http://google.com)http://google.com query=”what is a cookie?” http://search.comhttp://search.com?search=what%20is% 20a%20cookie?

9. The right side of ? window.location.search= "?" cpu uses to find query in URL "name" parameter's name "=" cpu uses to split name from value "value" parameter's value " &" cpu uses to separate parameters http://search.com?search=http://search.com?search=cars&account=john

10. Automatic Queries onSubmit browser MAKES QUERY Before cookies: Servers put state info into ALL URLs tag's hrefs, everything!

11. demo

12. DOM's location Object -hacked- javascript APIs can break rules location looks like a string location= "http://new website"; location.search = ? + right side of URL play with it in the Console (firebug)

13. Javascript String Object String objects have methods!!! substring(), substr() split() is extremely useful!.length = # of how long string is location.search.substr(start, length); location.split('?') -> array

14. DOM's encoders URL/URI have strict format rules space = %20, most stuff must be %hex encodeURI() / decodeURI() doesn't encode :// and some others encodeURIComponent() / decode…() encodes any possible troublemakers