Questions tagged [session]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
4answers
99 views

How can I store an user's capabilities to boost performance while allowing real-time updates of said capabilities?

I'm ingesting 150 objects that each require an user capabilities check, the function isUserAdmin tells me whether or not an user is an admin or not. Inside this function, there's a lot of deeper ...
1
vote
1answer
44 views

Using Django Sessions when views are accessed by API

I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
2
votes
0answers
24 views

How authorize web application and manage sessions

i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application! if it ...
0
votes
0answers
37 views

Is it a good practice to store session in two different places?

I have a use case like this and I am wondering if this solution is a good practice or not. Say I have a website called dashboard.com and this is only for US region. When users login here, I am ...
2
votes
2answers
92 views

How to combine session-based authentication and stateless REST API

What is the proper way of combining session-based authentication with stateless, token-based authentication for a REST API? Use case: User logs-in in the standard, traditional, session-based way. ...
0
votes
2answers
116 views

Improve website speed with better user session management

I have an ecommerce website wherein as soon as a new user comes on website then a new visitorId gets generated for that user in database and that visitorId cookie gets stored in his browser and in ...
-2
votes
1answer
63 views

Why does putty store sessions in the registry? [closed]

I recently wanted to copy my putty config from one laptop to another. I figured there would be a directory somewhere which stored the IP addresses etc as some form of text file. I was surprised to ...
0
votes
1answer
57 views

How to keep state alive between deployments

In our history, when we did a new release (deployment) any user who was "logged in" was logged out and that was obviously not ideal. Then I switched platform from a custom stack to a cloud provider ...
3
votes
0answers
89 views

Are session with cookie for authentication are dead? [closed]

I have an unpleasant discussion with a colleague who said using session in Java Web Application to validate authenticated users with cookies from Web browser after users logged in is problematic (...
0
votes
0answers
30 views

Handling session expiry in a javascript app without losing app state

Currently, when our SPA detects that our session has expired, we redirect to another page (domain) to login through a SSO solution, before being sent back to the original page. This has some ...
0
votes
0answers
29 views

State Management design

I am working a product which have WebApi Android/ios app Web app WebApi is hosted in AWS EC2 . Currently we have requirement like we need to mantain state. Take one scenario. App have 4 pages. ...
0
votes
1answer
58 views

Storing session state in browser's local storage

Stack Exchange has some bits of what seems to be session state -- for example, whether you want to see 15, 30, or 50 questions per page when you view a list of questions. You can click on the button ...
2
votes
0answers
408 views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
0
votes
2answers
892 views

Check if user is logged in when using JWT

I have an app that uses JWT tokens for user authorization. Now, I need to be capable of deactivating users (users won't be allowed to use the system but still exist in the database), but as a ...
0
votes
1answer
121 views

Multiple sessions accessing localhost database

I do not how to ask the question, but I am confused by how to manage sessions when the server is at local host. Accessing the database direct Without a middleware (REST), sessions are created as ...
1
vote
2answers
367 views

Security Issues with RESTful Authentication & Session Management

I'm trying to implement authentication and session management for a microservice. In order to do the process RESTfully, I understand that I'll need to use some kind of token-based authentication to ...
1
vote
1answer
275 views

User identity and microservices

I have created a User service that controls user login using OAuth2 protocol and stores the user in the local database. So this service is aware of the user session and user identity. Now I have ...
0
votes
2answers
1k views

How can I redirect to an ASP.NET MVC page with extended session?

Scenario We have an application which has a session timeout of 20 minutes. However we have a requirement in which users must be able to access a certain page in the site for 8 hours after the ...
0
votes
2answers
390 views

Is it right to keep users permissions in php session?

I try to integrate permissions for user and I want to find the best way for that. I think to save all permissions of the user in the session on login, but when permission will be changed by the admin, ...
3
votes
0answers
1k views

How to store unique sessions for logged in user(s) with different devices?

I want to do something like Facebook does. We can see any time where we're logged in. e.g.: Windows PC · New Delhi, India Edge · Active now Windows PC · New Delhi, India Chrome · 8 minutes ago ...
10
votes
2answers
11k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
-2
votes
1answer
88 views

Access Management of End User Data - End User Permission Tickets

I have been familiarizing myself with Googles Security Design Whitepaper. As far as I can understand, and with respect to a Micro-services architecture, from the Access Management of End User Data ...
-1
votes
1answer
220 views

How to make Azure Web App stateless

On Azure, Session Management can be done using Redis Cache. But this is not truly stateless. Is there a way to make a Web App in general, truly stateless? If yes, what pattern to follow specific to ...
8
votes
3answers
361 views

Authentication via tokens

I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner. Server Side Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
5
votes
2answers
12k views

RESTful API with session tokens.. ehh?

After looking at a lot of session/state debates with regard to REST and finding nothing concrete, I'm just going to cut to the chase and ask myself. Developing a RESTful API as a backend for a mobile ...
3
votes
2answers
2k views

Managing session timeouts with regards to user activity in the page

So I will be creating a feature to a php application that does the following: Create a session that expires after 30 minutes. After 30 minutes, if there is no user activity in the application (...
1
vote
2answers
2k views

ASP session between iframe and page

I have a situation where my ASP.NET MVC application can be loaded directly or in iframe. It uses ASP.NET Identity. When I open the site from iframe, log in and after open the site directly it keeps me ...
1
vote
2answers
2k views

Refreshing a token best practice

I have been asked to implement refreshing a token. A token ID is the same as a session ID. I have considered resetting the session's idle time to 0 and continue using the same session ID for the ...
1
vote
3answers
851 views

What is wrong with treating a client session as a resource/application state in REST architecture?

Given these example REST API / HATEOAS applications: InfoQ How to GET a Cup of Coffee example Java Spring REST API example ... where POST/PUT/PATCHING resources clearly alters the state/availability ...
0
votes
1answer
3k views

Using sessions with Jersey in a REST API

I am starting to develop a REST API with Jersey to retrieve a schedule for a given sport tournament. The client sends a JSON containing a tournament with its different categories, domain, definitions ...
8
votes
3answers
1k views

Best solution to authorize that a user is only allowed to modify/act with their own resources in a REST API

Background: Currently in the process of building out a REST API, using node w/express and it is consumed by a mobile app and eventually a (modern browser based) website. I'm trying to identify the ...
1
vote
0answers
962 views

How to persist a session cookie in a PSR7 request/response middleware?

I am building a package that implements native-like sessions in a PSR7 middleware architecture. I created a middleware which is responsible to create and persist a session cookie. The session is also ...
1
vote
1answer
2k views

Make PHP sessions truly last until the browser closes, and regenerating session on page requests

We have an issue where sessions are ending after a short time, 1440 seconds according to gc_maxlifetime settings which seems consistent with the issue. The PHPSESSID says it will expire when the ...
3
votes
0answers
46 views

Realtime layered time data storage and calculations

I am having a hard time trying to figure out the best way to report on and calculate layered time data. The problem: A person can sign in multiple times, during this sign in there are multiple ...
2
votes
1answer
959 views

Set authenticated users session cookie's to long term, but others to short term?

We want to extend the session duration for our users. I guess it doesn't matter for users who are not authenticated. We can create a PHPSESSID cookie for them and if it expires when they close their ...
0
votes
2answers
3k views

Shopping cart in PHP : Sessions or Database? [closed]

I am currently developing a simple shopping cart using PHP & HTML. I've been having troubles with using the SESSIONS in Php like: Sessions not continuing when I switch pages even though I ...
0
votes
1answer
578 views

sessions and stateless rest

I believe this question has been discussed to death. I was reading up on REST and it says that it has to be stateless. Yes i do understand there are application states and resource states. Taking ...
4
votes
1answer
167 views

Abstract/encapsulating session superglobal usage inside common accessor class

I am in the process of removing direct dependencies from an existing project. I have now come to removing the direct use of $_SESSION inside scripts. This is to make the same scripts available for an ...
-1
votes
1answer
208 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
4
votes
2answers
2k views

Storing session key in a hidden field

Background: I have a question which is outline at Use different local storage between windows. The very high level question is "How can I keep tabs and windows sessions from clashing". Requirement: ...
5
votes
1answer
6k views

Token based authentication and multiple sessions

I've a token based authentication system (REST) that I inherited for an iOS app (can't change), and I've to re-use the same authentication web api system (that I can change to adapt for the web ...
1
vote
0answers
5k views

Android, PHP session and JSON object retrieval

I am working on an app in android studio.. it currently has a login and registration system that are linked to a database and both work perfectly. I am now trying to carry over the user id value ...
0
votes
1answer
348 views

User sessions in a web server; speed or persistence?

I'm looking to implement sessions for a web server that I'm developing in my free time. Currently, it had cookie support, so users could implement their own session management, but this is something ...
2
votes
1answer
273 views

How do you implement an active sessions system like LinkedIn? [closed]

With some platforms, like LinkedIn, you can see a list of all sessions where you are logged in, and you can even log them out on a distance. How would you implement something like that? I'm not ...
0
votes
1answer
135 views

Using classes not designed for multiple sessions in servlet

I'm looking for a way to use a collection of Java classes in a servlet, which would provide some services to clients, but the classes were not designed with multiple sessions in mind, which seems to ...
3
votes
0answers
2k views

Managing Login Authentication/Webpage session: Can client side javascript/JQuery access either a session variable or json variable in html?

Short version: A variable is stored in a session variable req.session.userName and also in the json sent with res.render('/', {username: value}). How can I access either of those variables from inside ...
0
votes
2answers
188 views

Parameters Stored as Sessions - Pros / Cons?

Some background on my system: I have 1 query with multiple pages. There are filtering parameters on the left of the page which $_POSTs on submission. The posted parameters will change the query at ...
3
votes
1answer
104 views

Is “friendly fire” session replay a valid concern?

I've been reading a lot about sessions and security, trying to learn as much as possible before writing too much code. I've read about limiting session replay by including a timestamp within the ...
4
votes
1answer
540 views

Is my websocket session idea practical?

In a situation where all communication (including logging in) between a client (web browser) and server is done over a persistent TLS encrypted websocket, would there be anything inadvisable about ...
6
votes
2answers
496 views

How to handle a large amount of authenticated clients

I currently have made a multithreaded server in c++ for windows, where each connected client gets a thread to themselves which stays running until the client's socket is closed. When a client connects,...