Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I just wanted to get everyone's opinion on this, so I've been thinking about using a cookie I set on our ecommerce site to show customers different content when they return to the website. It is pretty simple to setup and I can set the expiration date far into the future to ensure that the cookie will present. What is everyone's thoughts?

EDIT: Just wanted to add - no personal information is stored in the cookie, only information about the source offer. So say the customer signed up through a Walmart promotion, they would be cookied and once they come back to the site - we read the cookie and show a welcome message for walmart customers

share|improve this question

migrated from stackoverflow.com Aug 7 '11 at 9:16

This question came from our site for professional and enthusiast programmers.

2  
Sounds like you're looking to use tailored content - I personally think it can be a good thing - tricky part is working out what and when to show different content, especially if there's the decision of either having your latest promotion or displaying something that the user has previously browsed... –  Doug McK Aug 5 '11 at 16:29
    
also the user might be coming back to your site from another device. i.e. mobile, tablet, work computer vs home computer, etc... –  house9 Aug 5 '11 at 16:32

3 Answers 3

up vote 4 down vote accepted

Customizing each user's experience is one of the great things about modern websites. Show them what they want to see!

As others have mentioned, you have to be careful about security. Not storing PII (personally identifiable information) in cookies is good practice. Commonly people store session identifiers in cookies. The big danger here is sidejacking. If your site is not using HTTPS, anybody can easily steal that session cookie and pretend to be another user. If your server supports it easily (it probably doesn't) just turn on HTTPS for everybody. Or make sure that an attacker who steals an HTTP session can't actually do anything meaningful -- switch to HTTPS before e-commerce, for example. Use a separate secure-only session identifier.

If all you're cookieing is a promotion / referral code that anybody could get, you're fine.

share|improve this answer

I don't think its much of a concern- as long as there is no personal information. You can also just store a token, and keep the unique stuff stored on your server.

--Dave

share|improve this answer

If you're showing information that might be personal, I won't recommend using a cookie, but using a server-side log-in mechanism.

Also, if the list is too long (a cookie may only hold 4kb of data), you should be using a unique id, easily generated in PHP or in JavaScript, and save all the data on the server, then when the user's cookie is presented to the server, it'll pull out the relevant data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.