Re: Re: Re: Secure Session Management

[valdez]

Your worries about compatibility can be solved using different solutions to the same problem. If you don't want cookies, then just use something like Apache::SessionManager, which can handle sessions inside URIs.

Of course, this doesn't resolve privacy issues, as you can imagine, because it is still possible to track a user even without cookies. On the other hand, it would be quite impossible to put something in a basket on Amazon or build something like PMonks, without something holding a state. So there is no escape, except honesty.

BTW, it is possible to expire AuthBasic accounts. Using cookies, just send an empty cookie (delete it) and the user will not enter your site without re-authentication. Under AuthBasic, just disable an account inside your htpasswd file. But you will need some more glue :-))

Ciao, Valerio

[BrowserUk]

Sorry for the rant about E-Trust and privacy policies. Valid rant, wrong time/place.

My original point about expiring sessions by deleting cookies still holds true though.

• User logs on, you give him a cookie
• User does some stuff
• User disconnects or moves to another site.
• Server expires session, but can't send a 'delete cookie', blank cookie, or 'Your logged off' msg to the client (using server push or not) because the client isn't there. No communication path at all.
• User returns a week later, issues a request against the client for whatever page they were on when here last (using a bookmark they made for example). The request arrives at the server with the auth. cookie still intact.

  Unless of course, the cookie was set to expire within a few minutes or hours, in which case the client won't send it. In this case, no action is required by the server to "determine a session is over" and it doesn't need to "tell the client to delete the cookie"?

Of course, this has flaws too. Cookies are text. Expiration times can be changed at the client. It therefore requires that the cookie carry an external and an internal expiration, with the internal expiration suitably encoded that edits can be detected.

My point was simply that if the session expires because the connection is broken, there is no mechanism by which the server can tell the client to delete the cookie.

---

Well It's better than the Abottoire, but Yorkshire!

[valdez]

Yes, valid rant, I agree with you.

Even with AuthBasic you can't notify disconnected users, so I think the point is to be able to delete a cookie if needed, and thus force a user to re-authenticate. Or may be you discover a fraud and want to throw away a user...

I hope I understood that correctly :)

Ciao, Valerio

Update: what you said about double expires still applies.