National Rail Enquiries - "Bad Request"

[mrmartin]

Yes - it's good practice to have your browser set to clear cookies every time you finish using it (assuming you let sites put cookies on your machine in the first place). Some log-in stuff can be automated on your own machine, rather than letting the website concerned do it with cookies, and keep track of you while they're at it.

Er, dont do this unless you like logging into sites over and over again.

I've also been seeing this error recently. It's almost certainly due to an overly long cookie string.

You shouldn't ever have to clear cookies to make a site work. It's a workaround pure and simple.

And suggesting people nuke all their cookies to make one site work is slightly mad. In today's world where people have hundreds of accounts, doing that probably results in hours of manually logging back into stuff (plus 2FA, new device alerts, etc).

 

[AlbertBeale]

Er, dont do this unless you like logging into sites over and over again.

I've also been seeing this error recently. It's almost certainly due to an overly long cookie string.

You shouldn't ever have to clear cookies to make a site work. It's a workaround pure and simple.

And suggesting people nuke all their cookies to make one site work is slightly mad. In today's world where people have hundreds of accounts, doing that probably results in hours of manually logging back into stuff (plus 2FA, new device alerts, etc).

Most sites which try to put persistent cookies on my machine (ie almost every website) is doing so not to save me a few keystrokes when connecting (which you rarely need to do anyway if most of your use of websites is to get information from the site rather than letting the site get information from you); rather it's putting cookies on your machine for its own purposes which are frequently detrimental to the user accessing the site.

And in any case, you don't need cookies to save log-in details in the first place. For instance, one of the computers I use to access this railforum website has my log-in details for this site saved on the browser I use on the machine (because I explicitly allowed the browser to save that information); hence I have no typing to do if I want to do connect to this site to engage with it, like now, even though the browser deletes all cookies completely every time I turn it off. And if I just want to look at the site, rather than engage with it, then no logging-in is needed in the first place.

In terms of "You shouldn't ever have to clear cookies to make a site work" - on the contrary, for some sites, to get them to work the way I want them to, as opposed to being constrained by the site owner, it can be essential to delete cookies.

 

[WelshBluebird]

As a web developer, I'd say that if someone wants to clear cookies often to avoid cross site tracking etc, then that is very much upto them. However it shouldn't be expected by the average user for a website to just work as it should!

Most sites which try to put persistent cookies on my machine (ie almost every website) is doing so not to save me a few keystrokes when connecting (which you rarely need to do anyway if most of your use of websites is to get information from the site rather than letting the site get information from you); rather it's putting cookies on your machine for its own purposes which are frequently detrimental to the user accessing the site.

A lot of cookies aren't for nefarious tracking purposes though. Sure a lot are for that, but a lot are also just for the basic operation of the site. Now by all means argue that maybe cookies shouldn't be used for that, but the reality is that they are and have been long before ad tracking cookies became a thing.

And in any case, you don't need cookies to save log-in details in the first place.

There's a difference between keeping you logged in across requests and saving log in details though. Sure you don't need cookies for the latter, and indeed cookies shouldn't be used for that, password managers should be. But cookies are useful for storing the fact you are logged in. In theory web servers should be stateless so your request to get say the "my account" page of a site after you have logged in wouldn't work if you don't also tell the server you are already logged in, and this is what cookies are used for in that scenario.