Cookies are stored on the client just like DOM Storage, so nothing is free when it comes to requests and communicating with the server. I understand that both still have their place. Though I generally prefer to use DOM Storage for most things now depending on the use case. I also complete agree about keeping server-side session data.
with "free" I meant without additional effort for the developer.
When you set a cookie with a Set-Cookie header, the client will automatically send the cookie with all further requests.
When you put the session-ID somewhere in DOM storage, you have to manually amend all requests with that session-ID - either by appending it as a get parameter or, when you do nothing but AJAX, as an additional request header - but whatever you do, it's considerably more effort.
Also, looking at our logs, I see way more users with DOM storage disabled than with cookies disabled, but that might just be my user base.
Alright, thanks for the clarification on "free", I realized that is what you might have meant after posting.
That last bit about your logs is surprising, thanks for that bit of info. I may need to go do the same. Either way I use a storage wrapper so I am accommodating both types of users.
