in reply to Re: Re: Re: Secure Session Management
in thread Secure Session Management

Sorry for the rant about E-Trust and privacy policies. Valid rant, wrong time/place.

My original point about expiring sessions by deleting cookies still holds true though.

Of course, this has flaws too. Cookies are text. Expiration times can be changed at the client. It therefore requires that the cookie carry an external and an internal expiration, with the internal expiration suitably encoded that edits can be detected.

My point was simply that if the session expires because the connection is broken, there is no mechanism by which the server can tell the client to delete the cookie.

Well It's better than the Abottoire, but Yorkshire!

Replies are listed 'Best First'.
Re: Re: Re: Re: Re: Secure Session Management
by valdez (Monsignor) on Sep 06, 2002 at 22:48 UTC

    Yes, valid rant, I agree with you.

    Even with AuthBasic you can't notify disconnected users, so I think the point is to be able to delete a cookie if needed, and thus force a user to re-authenticate. Or may be you discover a fraud and want to throw away a user...

    I hope I understood that correctly :)

    Ciao, Valerio

    Update: what you said about double expires still applies.