HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
mikewest
http-state-tokens
HTML2018–2020
mikewest / http-state-tokens

http-state-tokens

Incrementally better HTTP state management.

Web DevelopmentNetworking
Explore on GitHubRead Hacker News discussions
5Distinct people
5Mentions
0Explicit recommenders
298GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Incrementally better HTTP state management.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month5 dated mentions

Observed mentions: 2018-08-14 18:54:13 UTC to 2020-05-08 20:11:54 UTC.

0122018-08-01 00:00:00 UTC to 2018-09-01 00:00:00 UTC (exclusive): 2 mentions; 2 submissions, 0 commentsAug 20182018-09-01 00:00:00 UTC to 2018-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-10-01 00:00:00 UTC to 2018-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-11-01 00:00:00 UTC to 2018-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-12-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-01-01 00:00:00 UTC to 2019-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-02-01 00:00:00 UTC to 2019-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-03-01 00:00:00 UTC to 2019-04-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2019-04-01 00:00:00 UTC to 2019-05-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2019-05-01 00:00:00 UTC to 2019-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-06-01 00:00:00 UTC to 2019-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsJun 20192019-07-01 00:00:00 UTC to 2019-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-08-01 00:00:00 UTC to 2019-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-09-01 00:00:00 UTC to 2019-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-10-01 00:00:00 UTC to 2019-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-11-01 00:00:00 UTC to 2019-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-12-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-01-01 00:00:00 UTC to 2020-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-02-01 00:00:00 UTC to 2020-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-03-01 00:00:00 UTC to 2020-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-04-01 00:00:00 UTC to 2020-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-05-01 00:00:00 UTC to 2020-06-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 commentsMay 2020

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Aug 20182018-08-01 00:00:00 UTC2018-09-01 00:00:00 UTC220
Sep 20182018-09-01 00:00:00 UTC2018-10-01 00:00:00 UTC000
Oct 20182018-10-01 00:00:00 UTC2018-11-01 00:00:00 UTC000
Nov 20182018-11-01 00:00:00 UTC2018-12-01 00:00:00 UTC000
Dec 20182018-12-01 00:00:00 UTC2019-01-01 00:00:00 UTC000
Jan 20192019-01-01 00:00:00 UTC2019-02-01 00:00:00 UTC000
Feb 20192019-02-01 00:00:00 UTC2019-03-01 00:00:00 UTC000
Mar 20192019-03-01 00:00:00 UTC2019-04-01 00:00:00 UTC110
Apr 20192019-04-01 00:00:00 UTC2019-05-01 00:00:00 UTC101
May 20192019-05-01 00:00:00 UTC2019-06-01 00:00:00 UTC000
Jun 20192019-06-01 00:00:00 UTC2019-07-01 00:00:00 UTC000
Jul 20192019-07-01 00:00:00 UTC2019-08-01 00:00:00 UTC000
Aug 20192019-08-01 00:00:00 UTC2019-09-01 00:00:00 UTC000
Sep 20192019-09-01 00:00:00 UTC2019-10-01 00:00:00 UTC000
Oct 20192019-10-01 00:00:00 UTC2019-11-01 00:00:00 UTC000
Nov 20192019-11-01 00:00:00 UTC2019-12-01 00:00:00 UTC000
Dec 20192019-12-01 00:00:00 UTC2020-01-01 00:00:00 UTC000
Jan 20202020-01-01 00:00:00 UTC2020-02-01 00:00:00 UTC000
Feb 20202020-02-01 00:00:00 UTC2020-03-01 00:00:00 UTC000
Mar 20202020-03-01 00:00:00 UTC2020-04-01 00:00:00 UTC000
Apr 20202020-04-01 00:00:00 UTC2020-05-01 00:00:00 UTC000
May 20202020-05-01 00:00:00 UTC2020-06-01 00:00:00 UTC110

What Hacker News says

5 sources
tunetheweb·Apr 21, 2019
> But why is CSP harder to test than any other client-side change, like rewriting your login page/component? Maybe not so much now. But when I wrote that post there were lots of bugs and missing features across the various browsers (examples in the post). It was early days for CSP and it’s got better since (hence why I now do recommend CSP), but regardless CSP is a complex technology and tough to get right. Each page and each browser might have its own CSP requirements (e.g. when polyfills are included on a bad for example). > I meant to say that you can add it as a XSS prevention to example.com/app/ and not worry about example.com/static/ or example.com/blog/ Then your cookies are at risk. Yes cookies can be scoped to a path, but few do that. And they can be made HttpOnly which is more common, but still not used anywhere near enough (8.3
Read the rest
1% of cookies - https://github.com/mikewest/http-state-tokens/blob/master/RE...). Additionally if you have a vulnerability on /static/ then you can hijack the app link or login link to send users to badexample.com or similar when they want to login to the app. It will still offer some protection if only on /app/ and is better than nothing, but still preferable to have it on the whole domain. It’s like HTTPS - having it on just one page is an anti-pattern that shouldn’t be used anymore.
In Dangerous Web Security Features

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.