3

I just wanted to get everyone's opinion on this, so I've been thinking about using a cookie I set on our ecommerce site to show customers different content when they return to the website. It is pretty simple to setup and I can set the expiration date far into the future to ensure that the cookie will present. What is everyone's thoughts?

EDIT: Just wanted to add - no personal information is stored in the cookie, only information about the source offer. So say the customer signed up through a Walmart promotion, they would be cookied and once they come back to the site - we read the cookie and show a welcome message for walmart customers

Improve this question
2
  • 2
    Sounds like you're looking to use tailored content - I personally think it can be a good thing - tricky part is working out what and when to show different content, especially if there's the decision of either having your latest promotion or displaying something that the user has previously browsed...
    – Doug McK
    Aug 5, 2011 at 16:29
  • also the user might be coming back to your site from another device. i.e. mobile, tablet, work computer vs home computer, etc...
    – house9
    Aug 5, 2011 at 16:32

3 Answers 3

Reset to default
4

Customizing each user's experience is one of the great things about modern websites. Show them what they want to see!

As others have mentioned, you have to be careful about security. Not storing PII (personally identifiable information) in cookies is good practice. Commonly people store session identifiers in cookies. The big danger here is sidejacking. If your site is not using HTTPS, anybody can easily steal that session cookie and pretend to be another user. If your server supports it easily (it probably doesn't) just turn on HTTPS for everybody. Or make sure that an attacker who steals an HTTP session can't actually do anything meaningful -- switch to HTTPS before e-commerce, for example. Use a separate secure-only session identifier.

If all you're cookieing is a promotion / referral code that anybody could get, you're fine.

Improve this answer
0

I don't think its much of a concern- as long as there is no personal information. You can also just store a token, and keep the unique stuff stored on your server.

--Dave

Improve this answer
0

If you're showing information that might be personal, I won't recommend using a cookie, but using a server-side log-in mechanism.

Also, if the list is too long (a cookie may only hold 4kb of data), you should be using a unique id, easily generated in PHP or in JavaScript, and save all the data on the server, then when the user's cookie is presented to the server, it'll pull out the relevant data.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.