Beefy Boxes and Bandwidth Generously Provided by pair Networks
Keep It Simple, Stupid

comment on

( #3333=superdoc: print w/replies, xml ) Need Help??

Sorry for the rant about E-Trust and privacy policies. Valid rant, wrong time/place.

My original point about expiring sessions by deleting cookies still holds true though.

  • User logs on, you give him a cookie
  • User does some stuff
  • User disconnects or moves to another site.
  • Server expires session, but can't send a 'delete cookie', blank cookie, or 'Your logged off' msg to the client (using server push or not) because the client isn't there. No communication path at all.
  • User returns a week later, issues a request against the client for whatever page they were on when here last (using a bookmark they made for example). The request arrives at the server with the auth. cookie still intact.

    Unless of course, the cookie was set to expire within a few minutes or hours, in which case the client won't send it. In this case, no action is required by the server to "determine a session is over" and it doesn't need to "tell the client to delete the cookie"?

Of course, this has flaws too. Cookies are text. Expiration times can be changed at the client. It therefore requires that the cookie carry an external and an internal expiration, with the internal expiration suitably encoded that edits can be detected.

My point was simply that if the session expires because the connection is broken, there is no mechanism by which the server can tell the client to delete the cookie.

Well It's better than the Abottoire, but Yorkshire!

In reply to Re: Re: Re: Re: Secure Session Management by BrowserUk
in thread Secure Session Management by glickjd

Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":

  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.
  • Log In?

    What's my password?
    Create A New User
    and the web crawler heard nothing...

    How do I use this? | Other CB clients
    Other Users?
    Others chilling in the Monastery: (7)
    As of 2021-04-22 17:05 GMT
    Find Nodes?
      Voting Booth?

      No recent polls found