Questions tagged [session]
The session tag has no usage guidance.
106 questions
1
vote
1
answer
428
views
Should I store session id in server database?
I wanted to implement login system using flask framework. I managed to do this using sessions and set them to expire after 31 days and it works (sessions are created using server secret key, timestamp ...
- 21
1
vote
0
answers
78
views
Architecture Design using Queue and JWT Token for session management
I am planning to design a microservice system architecture for a ticketing platform. It will be similar to "TicketMaster". Here is the flow of my architecture:
client web browser
API ...
- 11
0
votes
1
answer
468
views
Optimal way Implement a Session Cache
I have an App that connects with Salesforce and do different operations. So I'm trying to implement a Session Cache for the Application to avoid repetitive login calls.
So far what I have done is I ...
- 11
0
votes
1
answer
963
views
Session Handover via OpenID Connect between a Mobile Application and a Website?
I am trying to assess secure ways to implement a session handover between an app and a website in the same company ecosystem.
The Setup
Mobile Application A and Website B use the same company OpenID ...
- 103
1
vote
0
answers
153
views
Managing user session state with Google Sign In
I need some help with my authentication design. Happy to share any code as needed...
Overview
I have implemented the Google Sign-in (new web implementation here) button in my client web application. ...
0
votes
1
answer
43
views
When dealing with session level data in a web app, is it better to maintain a static store of that data, or pass it around as needed?
I have a web app that is capable of connecting to multiple databases that are identical in structure but contain different data; each of our clients who uses the app gets their own copy of the ...
- 521
0
votes
1
answer
445
views
HTTPSession for session state in web APIs?
We are building a set of web APIs. The web APIs are called by clients & can call each other.
State is required by these APIs for the users session (e.g. shopping basket type stuff). The state ...
1
vote
1
answer
653
views
How to handle authentication & authorization inside microservices
Example Application
I will try to explain my problem by using a familiar application.
Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
- 173
1
vote
0
answers
259
views
Paginate large data and store in temporary table for navigation
I have implemented pagination using SQL and stored that result of search into temporary table.
Temporary table is named after unique tab id.
So that other tab can have seperate result sets.
That ...
0
votes
1
answer
3k
views
Is it good practice to save an entire ViewModel in Session (C# ASP.NET MVC)
I have an C# MVC Application which is basically a large application form. We are using a large ViewModel to store all the information the user enters as they pass through multiple steps in the ...
- 101
1
vote
0
answers
35
views
Spring Security SAML and RSA session
This is probably a design/architectural question.
My app uses RSA initiated SSO using SAML for authentication and from there on my app uses its own session to manage the request. There is a flaw in ...
- 119
1
vote
4
answers
118
views
How can I store an user's capabilities to boost performance while allowing real-time updates of said capabilities?
I'm ingesting 150 objects that each require an user capabilities check, the function isUserAdmin tells me whether or not an user is an admin or not. Inside this function, there's a lot of deeper ...
- 85
2
votes
1
answer
349
views
Using Django Sessions when views are accessed by API
I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
- 229
2
votes
0
answers
48
views
How authorize web application and manage sessions
i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application!
if it ...
- 129
0
votes
0
answers
58
views
Is it a good practice to store session in two different places?
I have a use case like this and I am wondering if this solution is a good practice or not.
Say I have a website called dashboard.com and this is only for US region. When users login here, I am ...
- 109
-2
votes
1
answer
113
views
How can I transfer a users information in a dashboard page after he/she logs in?
I am developing a Bank Management Project. Now I am stuck in a point. I want to create a login page where a user will submit his/her username and password then after clicks on the login button, a new ...
4
votes
2
answers
3k
views
How to combine session-based authentication and stateless REST API
What is the proper way of combining session-based authentication with stateless, token-based authentication for a REST API?
Use case:
User logs-in in the standard, traditional, session-based way. ...
- 51
0
votes
2
answers
209
views
Improve website speed with better user session management
I have an ecommerce website wherein as soon as a new user comes on website then a new visitorId gets generated for that user in database and that visitorId cookie gets stored in his browser and in ...
- 259
-1
votes
1
answer
152
views
Why does putty store sessions in the registry? [closed]
I recently wanted to copy my putty config from one laptop to another.
I figured there would be a directory somewhere which stored the IP addresses etc as some form of text file. I was surprised to ...
- 125
0
votes
1
answer
206
views
How to keep state alive between deployments
In our history, when we did a new release (deployment) any user who was "logged in" was logged out and that was obviously not ideal. Then I switched platform from a custom stack to a cloud provider ...
- 8,108
3
votes
0
answers
227
views
Are session with cookie for authentication are dead? [closed]
I have an unpleasant discussion with a colleague who said using session in Java Web Application to validate authenticated users with cookies from Web browser after users logged in is problematic (...
- 139
0
votes
0
answers
48
views
State Management design
I am working a product which have
WebApi
Android/ios app
Web app
WebApi is hosted in AWS EC2 .
Currently we have requirement like we need to mantain state. Take one scenario. App have 4 pages. ...
- 99
0
votes
1
answer
719
views
Storing session state in browser's local storage
Stack Exchange has some bits of what seems to be session state -- for example, whether you want to see 15, 30, or 50 questions per page when you view a list of questions.
You can click on the button ...
- 3,417
1
vote
0
answers
3k
views
How to support anonymous user in web application?
I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
- 27
1
vote
3
answers
6k
views
Check if user is logged in when using JWT
I have an app that uses JWT tokens for user authorization. Now, I need to be capable of deactivating users (users won't be allowed to use the system but still exist in the database), but as a ...
- 119
0
votes
1
answer
806
views
Multiple sessions accessing localhost database
I do not how to ask the question, but I am confused by how to manage sessions when the server is at local host.
Accessing the database direct
Without a middleware (REST), sessions are created as ...
- 113
2
votes
2
answers
685
views
Security Issues with RESTful Authentication & Session Management
I'm trying to implement authentication and session management for a microservice. In order to do the process RESTfully, I understand that I'll need to use some kind of token-based authentication to ...
- 131
2
votes
1
answer
1k
views
User identity and microservices
I have created a User service that controls user login using OAuth2 protocol and stores the user in the local database. So this service is aware of the user session and user identity.
Now I have ...
- 123
0
votes
2
answers
2k
views
How can I redirect to an ASP.NET MVC page with extended session?
Scenario
We have an application which has a session timeout of 20 minutes. However we have a requirement in which users must be able to access a certain page in the site for 8 hours after the ...
- 111
1
vote
2
answers
2k
views
Is it right to keep users permissions in php session?
I try to integrate permissions for user and I want to find the best way for that. I think to save all permissions of the user in the session on login, but when permission will be changed by the admin, ...
3
votes
0
answers
2k
views
How to store unique sessions for logged in user(s) with different devices?
I want to do something like Facebook does. We can see any time where we're logged in. e.g.:
Windows PC · New Delhi, India Edge · Active now
Windows PC · New Delhi, India Chrome · 8 minutes ago
...
- 163
12
votes
2
answers
13k
views
cookie vs. session vs jwt
I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge?
Cookies: in their early version, a text file with a unique client Id an all ...
- 231
-2
votes
1
answer
150
views
Access Management of End User Data - End User Permission Tickets
I have been familiarizing myself with Googles Security Design Whitepaper. As far as I can understand, and with respect to a Micro-services architecture, from the Access Management of End User Data ...
- 101
-1
votes
1
answer
313
views
How to make Azure Web App stateless
On Azure, Session Management can be done using Redis Cache. But this is not truly stateless.
Is there a way to make a Web App in general, truly stateless?
If yes, what pattern to follow specific to ...
8
votes
3
answers
389
views
Authentication via tokens
I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner.
Server Side
Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
- 241
8
votes
1
answer
19k
views
RESTful API with session tokens.. ehh?
After looking at a lot of session/state debates with regard to REST and finding nothing concrete, I'm just going to cut to the chase and ask myself.
Developing a RESTful API as a backend for a mobile ...
- 191
4
votes
2
answers
4k
views
Managing session timeouts with regards to user activity in the page
So I will be creating a feature to a php application that does the following:
Create a session that expires after 30 minutes.
After 30 minutes, if there is no user activity in the application (...
1
vote
2
answers
4k
views
ASP session between iframe and page
I have a situation where my ASP.NET MVC application can be loaded directly or in iframe. It uses ASP.NET Identity. When I open the site from iframe, log in and after open the site directly it keeps me ...
- 141
1
vote
2
answers
2k
views
Refreshing a token best practice
I have been asked to implement refreshing a token. A token ID is the same as a session ID. I have considered resetting the session's idle time to 0 and continue using the same session ID for the ...
- 129
1
vote
3
answers
1k
views
What is wrong with treating a client session as a resource/application state in REST architecture?
Given these example REST API / HATEOAS applications:
InfoQ How to GET a Cup of Coffee example
Java Spring REST API example
... where POST/PUT/PATCHING resources clearly alters the state/availability ...
- 580
0
votes
1
answer
4k
views
Using sessions with Jersey in a REST API
I am starting to develop a REST API with Jersey to retrieve a schedule for a given sport tournament. The client sends a JSON containing a tournament with its different categories, domain, definitions ...
- 2,256
9
votes
3
answers
3k
views
Best solution to authorize that a user is only allowed to modify/act with their own resources in a REST API
Background:
Currently in the process of building out a REST API, using node w/express and it is consumed by a mobile app and eventually a (modern browser based) website.
I'm trying to identify the ...
- 219
2
votes
0
answers
1k
views
How to persist a session cookie in a PSR7 request/response middleware?
I am building a package that implements native-like sessions in a PSR7 middleware architecture.
I created a middleware which is responsible to create and persist a session cookie. The session is also ...
- 129
1
vote
1
answer
4k
views
Make PHP sessions truly last until the browser closes, and regenerating session on page requests
We have an issue where sessions are ending after a short time, 1440 seconds according to gc_maxlifetime settings which seems consistent with the issue. The PHPSESSID says it will expire when the ...
- 795
3
votes
0
answers
52
views
Realtime layered time data storage and calculations
I am having a hard time trying to figure out the best way to report on and calculate layered time data.
The problem:
A person can sign in multiple times, during this sign in there are multiple ...
- 163
2
votes
1
answer
1k
views
Set authenticated users session cookie's to long term, but others to short term?
We want to extend the session duration for our users. I guess it doesn't matter for users who are not authenticated. We can create a PHPSESSID cookie for them and if it expires when they close their ...
- 795
0
votes
2
answers
6k
views
Shopping cart in PHP : Sessions or Database? [closed]
I am currently developing a simple shopping cart using PHP & HTML.
I've been having troubles with using the SESSIONS in Php like:
Sessions not continuing when I switch pages even though I ...
- 137
0
votes
1
answer
652
views
sessions and stateless rest
I believe this question has been discussed to death.
I was reading up on REST and it says that it has to be stateless.
Yes i do understand there are application states and resource states.
Taking ...
- 103
4
votes
1
answer
182
views
Abstract/encapsulating session superglobal usage inside common accessor class
I am in the process of removing direct dependencies from an existing project. I have now come to removing the direct use of $_SESSION inside scripts. This is to make the same scripts available for an ...
- 287
-1
votes
1
answer
280
views
Cookie name security
Is it a security hole to name each session with the username of the user currently logged in?
example:
//Alice has login
sessions_name('Alice'); sessions_start(); //Alice has login
//When Bob Logs ...
