0

I run Wordle-like, a daily word web-game that stores user stats and streaks in secure cookies when the users play.

The cookies are set to my users browsers with Secure; SameSite=Strict;

My current web host has Let's Encrypt built in with the service, so I've not handled the SSL-certificate myself in any way and don't think I have access to it. Due to server outages I'm now looking to migrate to a new web hosting solution.

So what I'm wondering is if the cookies in my users' browsers will still be readable by my JavaScript if I migrate to another server and set up a SSL-certificate for it, all while using the same domain name? So assuming the users still load the https-version of the site, and with the same URL, after the migration as well.

My gut feeling is that this should work, as otherwise ever updating or renewing the SSL-certificate would cause issues? But as giving players stats to care about and then removing those stats due to tech issues feels like a great way to get people to rage quit the game I would like to double-check with someone with more knowledge than my gut.

FurbyFubar
  • 1
  • 1
  • In short: cookies are specific for domain but not port nor scheme (http vs https) nor IP address for the domain. Thus even if changing the hoster (and thus IP but not domain) and using HTTPS you still get the cookies stored in the browser for the domain. – Steffen Ullrich May 29 '22 at 14:54

0 Answers0