Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [session]

The tag has no usage guidance.

0
votes
1answer
60 views

Multiple sessions accessing localhost database

I do not how to ask the question, but I am confused by how to manage sessions when the server is at local host. Accessing the database direct Without a middleware (REST), sessions are created as ...
1
vote
2answers
92 views

Security Issues with RESTful Authentication & Session Management

I'm trying to implement authentication and session management for a microservice. In order to do the process RESTfully, I understand that I'll need to use some kind of token-based authentication to ...
1
vote
1answer
75 views

User identity and microservices

I have created a User service that controls user login using OAuth2 protocol and stores the user in the local database. So this service is aware of the user session and user identity. Now I have ...
0
votes
2answers
591 views

How can I redirect to an ASP.NET MVC page with extended session?

Scenario We have an application which has a session timeout of 20 minutes. However we have a requirement in which users must be able to access a certain page in the site for 8 hours after the ...
0
votes
2answers
126 views

Is it right to keep users permissions in php session?

I try to integrate permissions for user and I want to find the best way for that. I think to save all permissions of the user in the session on login, but when permission will be changed by the admin, ...
2
votes
0answers
833 views

How to store unique sessions for logged in user(s) with different devices?

I want to do something like Facebook does. We can see any time where we're logged in. e.g.: Windows PC · New Delhi, India Edge · Active now Windows PC · New Delhi, India Chrome · 8 minutes ago ...
0
votes
0answers
47 views

How to implement a session mechanism for an always-open SaaS platform

The SaaS platform I'm working on should have a rather desktop-app-esque feel to it. Meaning it would be the main management software for my client's businesses and will be always open on their ...
8
votes
2answers
8k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
-2
votes
1answer
65 views

Access Management of End User Data - End User Permission Tickets

I have been familiarizing myself with Googles Security Design Whitepaper. As far as I can understand, and with respect to a Micro-services architecture, from the Access Management of End User Data ...
-1
votes
1answer
146 views

How to make Azure Web App stateless

On Azure, Session Management can be done using Redis Cache. But this is not truly stateless. Is there a way to make a Web App in general, truly stateless? If yes, what pattern to follow specific to ...
8
votes
3answers
344 views

Authentication via tokens

I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner. Server Side Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
6
votes
1answer
494 views

What is the best way to store and manage client <> server <> server and back session information and authorisation?

I have scenario, where I have javascript front-end connected using AJAX communicating with Django-Rest-Framework backend. Users authenticate using JWT tokens. Backend is acting as chatbot and ...
5
votes
2answers
7k views

RESTful API with session tokens.. ehh?

After looking at a lot of session/state debates with regard to REST and finding nothing concrete, I'm just going to cut to the chase and ask myself. Developing a RESTful API as a backend for a mobile ...
3
votes
2answers
2k views

Managing session timeouts with regards to user activity in the page

So I will be creating a feature to a php application that does the following: Create a session that expires after 30 minutes. After 30 minutes, if there is no user activity in the application (...
1
vote
2answers
950 views

ASP session between iframe and page

I have a situation where my ASP.NET MVC application can be loaded directly or in iframe. It uses ASP.NET Identity. When I open the site from iframe, log in and after open the site directly it keeps me ...
0
votes
0answers
209 views

What are the flaws in this method of session handling in a TCP/SSL Application?

First of all a little bit of background information that may assist you when approaching an answer for this question. I am developing a database application using Vb. Net as the client side ...
1
vote
2answers
1k views

Refreshing a token best practice

I have been asked to implement refreshing a token. A token ID is the same as a session ID. I have considered resetting the session's idle time to 0 and continue using the same session ID for the ...
1
vote
3answers
693 views

What is wrong with treating a client session as a resource/application state in REST architecture?

Given these example REST API / HATEOAS applications: InfoQ How to GET a Cup of Coffee example Java Spring REST API example ... where POST/PUT/PATCHING resources clearly alters the state/availability ...
0
votes
1answer
3k views

Using sessions with Jersey in a REST API

I am starting to develop a REST API with Jersey to retrieve a schedule for a given sport tournament. The client sends a JSON containing a tournament with its different categories, domain, definitions ...
8
votes
3answers
965 views

Best solution to authorize that a user is only allowed to modify/act with their own resources in a REST API

Background: Currently in the process of building out a REST API, using node w/express and it is consumed by a mobile app and eventually a (modern browser based) website. I'm trying to identify the ...
1
vote
0answers
796 views

How to persist a session cookie in a PSR7 request/response middleware?

I am building a package that implements native-like sessions in a PSR7 middleware architecture. I created a middleware which is responsible to create and persist a session cookie. The session is also ...
1
vote
1answer
1k views

Make PHP sessions truly last until the browser closes, and regenerating session on page requests

We have an issue where sessions are ending after a short time, 1440 seconds according to gc_maxlifetime settings which seems consistent with the issue. The PHPSESSID says it will expire when the ...
2
votes
0answers
39 views

Realtime layered time data storage and calculations

I am having a hard time trying to figure out the best way to report on and calculate layered time data. The problem: A person can sign in multiple times, during this sign in there are multiple ...
2
votes
1answer
689 views

Set authenticated users session cookie's to long term, but others to short term?

We want to extend the session duration for our users. I guess it doesn't matter for users who are not authenticated. We can create a PHPSESSID cookie for them and if it expires when they close their ...
0
votes
2answers
3k views

Shopping cart in PHP : Sessions or Database? [closed]

I am currently developing a simple shopping cart using PHP & HTML. I've been having troubles with using the SESSIONS in Php like: Sessions not continuing when I switch pages even though I ...
0
votes
1answer
451 views

sessions and stateless rest

I believe this question has been discussed to death. I was reading up on REST and it says that it has to be stateless. Yes i do understand there are application states and resource states. Taking ...
0
votes
0answers
760 views

I just want to clarify things about the behavior of Session in Asp.Net MVC

The reason why I asked this is because I want to know the basic principles about the behavior of a Session object. I'm working with session variables right now and I understand that it has a major ...
3
votes
1answer
125 views

Abstract/encapsulating session superglobal usage inside common accessor class

I am in the process of removing direct dependencies from an existing project. I have now come to removing the direct use of $_SESSION inside scripts. This is to make the same scripts available for an ...
-1
votes
1answer
132 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
4
votes
2answers
2k views

Storing session key in a hidden field

Background: I have a question which is outline at Use different local storage between windows. The very high level question is "How can I keep tabs and windows sessions from clashing". Requirement: ...
5
votes
1answer
5k views

Token based authentication and multiple sessions

I've a token based authentication system (REST) that I inherited for an iOS app (can't change), and I've to re-use the same authentication web api system (that I can change to adapt for the web ...
1
vote
0answers
4k views

Android, PHP session and JSON object retrieval

I am working on an app in android studio.. it currently has a login and registration system that are linked to a database and both work perfectly. I am now trying to carry over the user id value ...
0
votes
1answer
314 views

User sessions in a web server; speed or persistence?

I'm looking to implement sessions for a web server that I'm developing in my free time. Currently, it had cookie support, so users could implement their own session management, but this is something ...
2
votes
1answer
253 views

How do you implement an active sessions system like LinkedIn? [closed]

With some platforms, like LinkedIn, you can see a list of all sessions where you are logged in, and you can even log them out on a distance. How would you implement something like that? I'm not ...
0
votes
1answer
115 views

Using classes not designed for multiple sessions in servlet

I'm looking for a way to use a collection of Java classes in a servlet, which would provide some services to clients, but the classes were not designed with multiple sessions in mind, which seems to ...
2
votes
0answers
1k views

Managing Login Authentication/Webpage session: Can client side javascript/JQuery access either a session variable or json variable in html?

Short version: A variable is stored in a session variable req.session.userName and also in the json sent with res.render('/', {username: value}). How can I access either of those variables from inside ...
0
votes
2answers
178 views

Parameters Stored as Sessions - Pros / Cons?

Some background on my system: I have 1 query with multiple pages. There are filtering parameters on the left of the page which $_POSTs on submission. The posted parameters will change the query at ...
3
votes
1answer
103 views

Is “friendly fire” session replay a valid concern?

I've been reading a lot about sessions and security, trying to learn as much as possible before writing too much code. I've read about limiting session replay by including a timestamp within the ...
4
votes
1answer
517 views

Is my websocket session idea practical?

In a situation where all communication (including logging in) between a client (web browser) and server is done over a persistent TLS encrypted websocket, would there be anything inadvisable about ...
6
votes
2answers
466 views

How to handle a large amount of authenticated clients

I currently have made a multithreaded server in c++ for windows, where each connected client gets a thread to themselves which stays running until the client's socket is closed. When a client connects,...
0
votes
1answer
85 views

Sessions in cloud applications dangerous?

We have a django app hosted on heroku. I had a situation: A user entered an email in a form on page1. If the email existed in the database he was redirected to Login page otherwise to register page. ...
0
votes
1answer
3k views

Knowing who is the user in every request (every action, every view, every time)

I have many model classes that are mapped from/to tables using EF. Two of them are User and UserCookie, which are stored in tables Users and UserCookies. public class User { public long UserId { ...
0
votes
0answers
139 views

Session Management in distributable web-apps

I am working on a huge web application in which I need to add transparent failover feature. I understand the necessary steps to make a web application distributable, the most difficult thing being: to ...
0
votes
2answers
3k views

How does Facebook manage to allow a user unlimited sessions?

I could login through the website, android app, iOS app, the browsers on mobile, and when I log out from one, it doesn't log me out of all of them. Traditionally, you would log out of all the services ...
26
votes
5answers
9k views

Why can't we use IP address instead of cookies in identifying the client in servlets?

I know we have some extra advantages in using the cookies over IP address, but my question is Why can't the container just remember the IP address of the client in identifying the client when he visit ...
0
votes
1answer
945 views

How to update last accessed with Forms Authentication cookie

I've got an MVC 4 site where I'm using Forms Authentication. I'm setting a cookie when a user logs in. The majority of my site does NOT require a user to be logged in though. What I'd like to do, ...
1
vote
0answers
282 views

How to validate information on server without using database or session

Each user has multiple sites they can access reporting data for in an application I am working on. To prevent having to go to the database on every single request, I validate that they have access to ...
6
votes
4answers
9k views

How to store Role Based Access rights in web application?

Currently working on a web based CRM type system that deals with various Modules such as Companies, Contacts, Projects, Sub Projects, etc. A typical CRM type system (asp.net web form, C#, SQL Server ...
0
votes
0answers
122 views

How does session middleware generally verify browser sessions?

I've been using session middleware to build web apps for years: from PHP's built-in session handling layer to node's connect session middleware. However, I've never tried (or needed) to roll my own ...
2
votes
1answer
3k views

Session serialization in JavaEE environment

Please consider the following scenario: We are working on a JavaEE project for which the scalability starts to become an issue. Up until now, we were able to scale up but this is no longer an option. ...