Re: [WebDNA] Secure Cookies
This WebDNA talk-list message is from 2009
It keeps the original formatting.
numero = 103891
interpreted = N
texte = --00c09ffb525311a5960476e6264e Content-Type: text/plain; charset=UTF-8 Hi guys, I do the following for session cookies: 1. When a user logs in I create a record in a sessionDB that includes their userID, the time in seconds since epoch, and a unique sessionID using [cart] 2. I set the sessionID as a cookie 3. Each site has a default timeout - usually 30mins, each time a user refreshes a page I reset the time in the session db 4. If the user is inactive for over 30mins then they are kicked out at the next attempt to access a page and the record in the sessionDB is deleted 5. I run an hourly trigger that deletes any records in the sessionDB where the time is over 30mins old I use this for admin pages on our CMS, so I do not use persistent cookies. I can't see how encrypting the session cookie improves security in this context. Finally one thing I don't do is check the clients IP, I found that some users accessing the net from within large corporations (i.e Microsoft) accessed the site using different IPs even within the same session. I assume this must be a security feature on the Microsoft end. Take care - Tom --00c09ffb525311a5960476e6264e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi guys,
I do the following for session cookies:
1. When a user logs in I create a record in a sessionDB t= hat includes their userID, the time in seconds since epoch, and a unique se= ssionID using [cart]
2. I set the sessionID as a cookie
= 3. Each site has a default timeout - usually 30mins, each time a user = refreshes a page I reset the time in the session db
4. If the user is inactive for over 30mins then they are kicked out at= the next attempt to access a page and the record in the sessionDB is delet= ed
5. I run an hourly trigger that deletes any rec= ords in the sessionDB where the time is over 30mins old
I use this for admin pages on our CMS, so I do not use = persistent cookies. =C2=A0I can't see how encrypting the session cookie= improves security in this context.
Finally one th= ing I don't do is check the clients IP, I found that some users accessi= ng the net from within large corporations (i.e Microsoft) accessed the site= using different IPs even within the same session. =C2=A0 I assume this mus= t be a security feature on the Microsoft end.
Take care
- Tom
=
--00c09ffb525311a5960476e6264e--
Associated Messages, from the most recent to the oldest:
--00c09ffb525311a5960476e6264e Content-Type: text/plain; charset=UTF-8 Hi guys, I do the following for session cookies: 1. When a user logs in I create a record in a sessionDB that includes their userID, the time in seconds since epoch, and a unique sessionID using [cart] 2. I set the sessionID as a cookie 3. Each site has a default timeout - usually 30mins, each time a user refreshes a page I reset the time in the session db 4. If the user is inactive for over 30mins then they are kicked out at the next attempt to access a page and the record in the sessionDB is deleted 5. I run an hourly trigger that deletes any records in the sessionDB where the time is over 30mins old I use this for admin pages on our CMS, so I do not use persistent cookies. I can't see how encrypting the session cookie improves security in this context. Finally one thing I don't do is check the clients IP, I found that some users accessing the net from within large corporations (i.e Microsoft) accessed the site using different IPs even within the same session. I assume this must be a security feature on the Microsoft end. Take care - Tom --00c09ffb525311a5960476e6264e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi guys,
I do the following for session cookies:
1. When a user logs in I create a record in a sessionDB t= hat includes their userID, the time in seconds since epoch, and a unique se= ssionID using
[cart]
2. I set the sessionID as a cookie
= 3. Each site has a default timeout - usually 30mins, each time a user = refreshes a page I reset the time in the session db
4. If the user is inactive for over 30mins then they are kicked out at= the next attempt to access a page and the record in the sessionDB is delet= ed
5. I run an hourly trigger that deletes any rec= ords in the sessionDB where the time is over 30mins old
I use this for admin pages on our CMS, so I do not use = persistent cookies. =C2=A0I can't see how encrypting the session cookie= improves security in this context.
Finally one th= ing I don't do is check the clients IP, I found that some users accessi= ng the net from within large corporations (i.e Microsoft) accessed the site= using different IPs even within the same session. =C2=A0 I assume this mus= t be a security feature on the Microsoft end.
Take care
- Tom
=
--00c09ffb525311a5960476e6264e--
Tom Duke
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
using listfiles to build a database? (2000)
Word Breaks (1998)
Extracting URL (2007)
[convertChars] and HTML Tags (1997)
RE: Jimmy Houssen (1998)
How Many SKU's is enough? (1997)
[SearchString] problem with [search] context (1997)
[WebDNA] User sessions - cookies only or cookies and a sessions.db? (2016)
THANKS (1997)
Need relative path explanation (1997)
Most Efficiant Way to do restricted Areas (1997)
Reserved Words (2003)
Sort Order on a page search (1997)
Include file not working on remote directory. (2004)
WebCat2 - storing unformatted date data? (1997)
Applescript in Webcatalog problem (1997)
OK, here goes... (1997)
problems with 2 tags (1997)
[WebDNA] reverse rank=off (2008)
Two submit buttons ? (1997)