Questions tagged [session]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
35 views

When dealing with session level data in a web app, is it better to maintain a static store of that data, or pass it around as needed?

I have a web app that is capable of connecting to multiple databases that are identical in structure but contain different data; each of our clients who uses the app gets their own copy of the ...
0
votes
1answer
41 views

HTTPSession for session state in web APIs?

We are building a set of web APIs. The web APIs are called by clients & can call each other. State is required by these APIs for the users session (e.g. shopping basket type stuff). The state ...
0
votes
1answer
74 views

How to handle authentication & authorization inside microservices

Example Application I will try to explain my problem by using a familiar application. Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
0
votes
0answers
24 views

Paginate large data and store in temporary table for navigation

I have implemented pagination using SQL and stored that result of search into temporary table. Temporary table is named after unique tab id. So that other tab can have seperate result sets. That ...
0
votes
1answer
238 views

Is it good practice to save an entire ViewModel in Session (C# ASP.NET MVC)

I have an C# MVC Application which is basically a large application form. We are using a large ViewModel to store all the information the user enters as they pass through multiple steps in the ...
0
votes
0answers
36 views

How do I properly secure a Spring Boot app serving server-side rendered pages and API?

I'm wondering how do I properly secure this example app (https://github.com/brunodrugowick/spring-thymeleaf-vue-crud-example). The app is: A Spring (Boot) app with server-rendered pages via ...
1
vote
0answers
16 views

Spring Security SAML and RSA session

This is probably a design/architectural question. My app uses RSA initiated SSO using SAML for authentication and from there on my app uses its own session to manage the request. There is a flaw in ...
1
vote
4answers
104 views

How can I store an user's capabilities to boost performance while allowing real-time updates of said capabilities?

I'm ingesting 150 objects that each require an user capabilities check, the function isUserAdmin tells me whether or not an user is an admin or not. Inside this function, there's a lot of deeper ...
1
vote
1answer
58 views

Using Django Sessions when views are accessed by API

I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
2
votes
0answers
26 views

How authorize web application and manage sessions

i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application! if it ...
0
votes
0answers
40 views

Is it a good practice to store session in two different places?

I have a use case like this and I am wondering if this solution is a good practice or not. Say I have a website called dashboard.com and this is only for US region. When users login here, I am ...
-2
votes
1answer
46 views

How can I transfer a users information in a dashboard page after he/she logs in?

I am developing a Bank Management Project. Now I am stuck in a point. I want to create a login page where a user will submit his/her username and password then after clicks on the login button, a new ...
2
votes
2answers
175 views

How to combine session-based authentication and stateless REST API

What is the proper way of combining session-based authentication with stateless, token-based authentication for a REST API? Use case: User logs-in in the standard, traditional, session-based way. ...
0
votes
2answers
117 views

Improve website speed with better user session management

I have an ecommerce website wherein as soon as a new user comes on website then a new visitorId gets generated for that user in database and that visitorId cookie gets stored in his browser and in ...
-2
votes
1answer
71 views

Why does putty store sessions in the registry? [closed]

I recently wanted to copy my putty config from one laptop to another. I figured there would be a directory somewhere which stored the IP addresses etc as some form of text file. I was surprised to ...
0
votes
1answer
72 views

How to keep state alive between deployments

In our history, when we did a new release (deployment) any user who was "logged in" was logged out and that was obviously not ideal. Then I switched platform from a custom stack to a cloud provider ...
3
votes
0answers
99 views

Are session with cookie for authentication are dead? [closed]

I have an unpleasant discussion with a colleague who said using session in Java Web Application to validate authenticated users with cookies from Web browser after users logged in is problematic (...
0
votes
0answers
32 views

State Management design

I am working a product which have WebApi Android/ios app Web app WebApi is hosted in AWS EC2 . Currently we have requirement like we need to mantain state. Take one scenario. App have 4 pages. ...
0
votes
1answer
127 views

Storing session state in browser's local storage

Stack Exchange has some bits of what seems to be session state -- for example, whether you want to see 15, 30, or 50 questions per page when you view a list of questions. You can click on the button ...
2
votes
0answers
715 views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
1
vote
2answers
2k views

Check if user is logged in when using JWT

I have an app that uses JWT tokens for user authorization. Now, I need to be capable of deactivating users (users won't be allowed to use the system but still exist in the database), but as a ...
0
votes
1answer
275 views

Multiple sessions accessing localhost database

I do not how to ask the question, but I am confused by how to manage sessions when the server is at local host. Accessing the database direct Without a middleware (REST), sessions are created as ...
2
votes
2answers
480 views

Security Issues with RESTful Authentication & Session Management

I'm trying to implement authentication and session management for a microservice. In order to do the process RESTfully, I understand that I'll need to use some kind of token-based authentication to ...
2
votes
1answer
454 views

User identity and microservices

I have created a User service that controls user login using OAuth2 protocol and stores the user in the local database. So this service is aware of the user session and user identity. Now I have ...
0
votes
2answers
1k views

How can I redirect to an ASP.NET MVC page with extended session?

Scenario We have an application which has a session timeout of 20 minutes. However we have a requirement in which users must be able to access a certain page in the site for 8 hours after the ...
0
votes
2answers
698 views

Is it right to keep users permissions in php session?

I try to integrate permissions for user and I want to find the best way for that. I think to save all permissions of the user in the session on login, but when permission will be changed by the admin, ...
3
votes
0answers
1k views

How to store unique sessions for logged in user(s) with different devices?

I want to do something like Facebook does. We can see any time where we're logged in. e.g.: Windows PC · New Delhi, India Edge · Active now Windows PC · New Delhi, India Chrome · 8 minutes ago ...
12
votes
2answers
12k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
-2
votes
1answer
107 views

Access Management of End User Data - End User Permission Tickets

I have been familiarizing myself with Googles Security Design Whitepaper. As far as I can understand, and with respect to a Micro-services architecture, from the Access Management of End User Data ...
-1
votes
1answer
236 views

How to make Azure Web App stateless

On Azure, Session Management can be done using Redis Cache. But this is not truly stateless. Is there a way to make a Web App in general, truly stateless? If yes, what pattern to follow specific to ...
8
votes
3answers
376 views

Authentication via tokens

I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner. Server Side Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
7
votes
2answers
14k views

RESTful API with session tokens.. ehh?

After looking at a lot of session/state debates with regard to REST and finding nothing concrete, I'm just going to cut to the chase and ask myself. Developing a RESTful API as a backend for a mobile ...
3
votes
2answers
2k views

Managing session timeouts with regards to user activity in the page

So I will be creating a feature to a php application that does the following: Create a session that expires after 30 minutes. After 30 minutes, if there is no user activity in the application (...
1
vote
2answers
2k views

ASP session between iframe and page

I have a situation where my ASP.NET MVC application can be loaded directly or in iframe. It uses ASP.NET Identity. When I open the site from iframe, log in and after open the site directly it keeps me ...
1
vote
2answers
2k views

Refreshing a token best practice

I have been asked to implement refreshing a token. A token ID is the same as a session ID. I have considered resetting the session's idle time to 0 and continue using the same session ID for the ...
1
vote
3answers
977 views

What is wrong with treating a client session as a resource/application state in REST architecture?

Given these example REST API / HATEOAS applications: InfoQ How to GET a Cup of Coffee example Java Spring REST API example ... where POST/PUT/PATCHING resources clearly alters the state/availability ...
0
votes
1answer
4k views

Using sessions with Jersey in a REST API

I am starting to develop a REST API with Jersey to retrieve a schedule for a given sport tournament. The client sends a JSON containing a tournament with its different categories, domain, definitions ...
8
votes
3answers
1k views

Best solution to authorize that a user is only allowed to modify/act with their own resources in a REST API

Background: Currently in the process of building out a REST API, using node w/express and it is consumed by a mobile app and eventually a (modern browser based) website. I'm trying to identify the ...
2
votes
0answers
1k views

How to persist a session cookie in a PSR7 request/response middleware?

I am building a package that implements native-like sessions in a PSR7 middleware architecture. I created a middleware which is responsible to create and persist a session cookie. The session is also ...
1
vote
1answer
2k views

Make PHP sessions truly last until the browser closes, and regenerating session on page requests

We have an issue where sessions are ending after a short time, 1440 seconds according to gc_maxlifetime settings which seems consistent with the issue. The PHPSESSID says it will expire when the ...
3
votes
0answers
49 views

Realtime layered time data storage and calculations

I am having a hard time trying to figure out the best way to report on and calculate layered time data. The problem: A person can sign in multiple times, during this sign in there are multiple ...
2
votes
1answer
1k views

Set authenticated users session cookie's to long term, but others to short term?

We want to extend the session duration for our users. I guess it doesn't matter for users who are not authenticated. We can create a PHPSESSID cookie for them and if it expires when they close their ...
0
votes
2answers
4k views

Shopping cart in PHP : Sessions or Database? [closed]

I am currently developing a simple shopping cart using PHP & HTML. I've been having troubles with using the SESSIONS in Php like: Sessions not continuing when I switch pages even though I ...
0
votes
1answer
610 views

sessions and stateless rest

I believe this question has been discussed to death. I was reading up on REST and it says that it has to be stateless. Yes i do understand there are application states and resource states. Taking ...
4
votes
1answer
174 views

Abstract/encapsulating session superglobal usage inside common accessor class

I am in the process of removing direct dependencies from an existing project. I have now come to removing the direct use of $_SESSION inside scripts. This is to make the same scripts available for an ...
-1
votes
1answer
231 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
4
votes
2answers
3k views

Storing session key in a hidden field

Background: I have a question which is outline at Use different local storage between windows. The very high level question is "How can I keep tabs and windows sessions from clashing". Requirement: ...
5
votes
1answer
6k views

Token based authentication and multiple sessions

I've a token based authentication system (REST) that I inherited for an iOS app (can't change), and I've to re-use the same authentication web api system (that I can change to adapt for the web ...
1
vote
0answers
5k views

Android, PHP session and JSON object retrieval

I am working on an app in android studio.. it currently has a login and registration system that are linked to a database and both work perfectly. I am now trying to carry over the user id value ...
0
votes
1answer
368 views

User sessions in a web server; speed or persistence?

I'm looking to implement sessions for a web server that I'm developing in my free time. Currently, it had cookie support, so users could implement their own session management, but this is something ...