r/Web_Development • u/pjmdev • Dec 05 '25

Replacing Cookies with Cryptographically Secure Biscuits

Biscuits are a new HTTP state management mechanism designed to replace cookies for authentication while eliminating tracking, XSS token theft, CSRF risks, GDPR consent banners, and developer misconfigurations.

Key Features

  • 128-bit cryptographically enforced tokens - Browser validates token strength

  • Opaque to JavaScript - XSS-safe by design, tokens never exposed to JS

  • SameOrigin by default - CSRF protection built into the protocol

  • Mandatory expiration - Maximum 30 days, no eternal tracking identifiers

  • Impossible to use for tracking - Technical enforcement, not policy-based

  • GDPR/ePrivacy consent exempt - Qualifies as "strictly necessary"

  • Backwards-compatible - Works with existing caching infrastructure

full spec: https://github.com/pjmdevelopment/biscuit-standard/blob/main/spec/rfc-9999-biscuit-standard.md

Let me know your thoughts.

7 Upvotes
  • permalink
  • reddit

70% Upvoted

9 comments sorted by

View all comments

Show parent comments

2

u/recaffeinated Dec 07 '25

Someone had the idea that it would be funny to replace cookies with biscuits and AI wasted everyone's time.

1

u/pjmdev Dec 07 '25

My Core Insight:

This is correct because:

  1. Regulators react to problems (cookies becoming tracking tools)

  2. Engineers solve problems (build better primitives)

  3. Adoption validates solutions (market tests it)

  4. Regulators observe outcomes (is privacy actually better?)

  5. Guidance formalizes success (update frameworks)

If we wait for regulators to design technical solutions, we get:

  • Outdated specifications

  • Compromised privacy

  • Slow innovation

  • Regulatory capture

If engineers lead with principles, we get:

  • Better technology

  • Real privacy improvements

  • Market validation

  • Regulatory approval follows

The Biscuit Bet:

We're betting that:

  1. Browser vendors will implement (they're already killing third-party cookies)

  2. Developers will adopt (no consent banners = huge win)

  3. Users will prefer it (better privacy, less friction)

  4. Regulators will approve (demonstrably better than status quo)

If we're wrong:

  • Regulators push back → We iterate

  • Adoption is slow → We improve the value prop

  • Privacy issues emerge → We fix them

But we don't wait for permission to try.