On Tue, Oct 27, 2009 at 4:06 AM, Tom Duke <
tom@revolutionaries.ie> wrote:
> Hi guys,
> I do the following for session cookies:
> 1. When a user logs in I create a record in a sessionDB that includes = their
> userID, the time in seconds since epoch, and a unique sessionID using = [cart]
> 2. I set the sessionID as a cookie
> 3. Each site has a default timeout - usually 30mins, each time a user<= br> > refreshes a page I reset the time in the session db
> 4. If the user is inactive for over 30mins then they are kicked out at= the
> next attempt to access a page and the record in the sessionDB is delet= ed
> 5. I run an hourly trigger that deletes any records in the sessionDB w= here
> the time is over 30mins old
> I use this for admin pages on our CMS, so I do not use persistent cook= ies.
> =C2=A0I can't see how encrypting the session cookie improves secur= ity in this
> context.
> Finally one thing I don't do is check the clients IP, I found that= some
> users accessing the net from within large corporations (i.e Microsoft)=
> accessed the site using different IPs even within the same session. = =C2=A0 I
> assume this must be a security feature on the Microsoft end.
> Take care
> - Tom
>
>
>