Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been working with Indy 10 HTTP Servers / Clients lately in Delphi XE2, and I need to make sure I'm understanding session management correctly. In the server, I have a "bucket" of sessions, which is a list of objects which each represent a unique session. I don't use username and password to authenticate users, but I rather use a unique API key which is issued to a client, and has an expiration.

When a client wishes to connect to the server, it first logs in by calling the "login" command, which is a path like this: http://localhost:1234/login?APIKey=abcdefghij. The server checks this API Key against the database, and if it's valid, it creates a new session in the bucket, issues a new cookie (unique string), and sets the response cookies with Success=Y and Cookie=abcdefghij.

This is where I have the question. Assuming the client end has its own method of cookie management, the client will receive this login response back from the server and automatically save the cookies as necessary. Any future request from the client to the server shall automatically send along these cookies, and the client side doesn't have to necessarily worry about setting these cookies when sending requests to the server. Right?

PS - I'm asking this question here on because I didn't see it fit to ask on If anyone thinks this is appropriate enough for, please let me know.

share|improve this question
I should have made one thing a little more clear - On the client side, I'm using Indy's TIdHTTP to fetch the data from the server. The question I'm really asking is does this component automatically save cookies, or do I have to do something extra to give it a cookie manager? – Jerry Dodge Dec 3 '12 at 16:40
up vote 4 down vote accepted

Yes, the client - assuming a web browser - would send the cookie for that domain. You dont need to send it each time. Though a lot of applications do send the cookie back with each page so as to extend the expiration of the cookie.

You probably dont need the 'success' field - either the session id stored in the cookie is going to be valid, or it isnt. If you are actually trying to return success or failure to the client, send back a bit of JSON instead as part of the response body. That will be easier to handle on the client side in javascript.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.