session id is shown on the address bar
Added by bo bosh about 12 years ago
Hi there,
I have created a website with a login page. Only a single user can be logged in at the same time.
Also in order to avoid creating new session when refreshing, I have added false to wt-config.xml.
However, the session-id was displayed on the address bar, which could be used for session-hijacking. Thus, I also added Auto,
so the session-id will be stored on a cookie. However, I am still not satisfied:
If I forget to enable my cookies, then the session-id is back to the address bar. So what I have done is implementing a refresh function, which
if the cookies aren't enabled, the session is quit() and you get back to the login screen again. Unfortunately, the session-id is still an issue, because
when using redirect(bookmarkUrl()), I get a new session-id on the address bar. How can I fix it?
I mean, when I didn't set the reload-is-new-session, it didn't show the session-id,
so I guess there is a way to do this in this case too...
I hope I have made myself clear.
Thanks in advance.
Replies (9)
RE: session id is shown on the address bar - Added by Koen Deforche about 12 years ago
Hey,
We really recommend to work with the default settings (reload-is-new-session = true). Perhaps you have a different expectation for the 'session' than Wt: Wt requires a separate session for every open 'window' to an application.
Why do you not want a new session when the user reloads ?
Regards,
koen
RE: session id is shown on the address bar - Added by bo bosh about 12 years ago
First of all, thanks for the fast response.
Regarding your question, there is some data (tables) that are modified and needed to be refreshed. Although, I have a button with the label 'refresh', it
is more intuitive to press F5, what causes the login screen to come up.
If you have an idea, I would love to hear it.
Also, I wonder how the session-id is saved, when the reload-is-new-session = true. I may simulate/"mimic" it.
Thanks in advance
RE: session id is shown on the address bar - Added by Koen Deforche about 12 years ago
Hey,
Then you should remember the identity of the user using 'remember-me' functionality (Wt::Auth has this) which will by-pass the login screen for the user in a new session (using a cookie that identifies and authenticates the user, not the session !).
If you have multiple screens and you want the user to return to the correct screen, then you need to implement the internal path API.
As to the session ID: the default behavior is to never refresh the screen and thus the session ID is always url-encoded in ajax requests (and private resource requests).
Regards,
koen
RE: session id is shown on the address bar - Added by bo bosh about 12 years ago
I probably didn't understand your suggestions, so excuse me if I have gotten you wrong.
I am talking about the case that the user doesn't enable cookies in his browser, and by
that causing the session-id to be displayed on the address bar, which I don't want it to happen.
How can I hide it from the address bar? I can't save it in a cookie (cause the browser doesn't enable cookies) and I don't understand a thing about url-encoded ajax request.
Once again, sorry for bothering you much...
Thanks a lot for the support. =]
RE: session id is shown on the address bar - Added by Koen Deforche about 12 years ago
Hey,
Revert to the default settings, this works fine without cookie support.
Until the user does a reload and expects to keep information : that requires a cookie but that is also expected ? The session Id is either in the URL or in a cookie. There are no other options.
Koen
RE: session id is shown on the address bar - Added by bo bosh about 12 years ago
Okay, I reverted only the reload-is-new-session (it is now set to true), but it doesn't work.
I see that the session is saved in a cookie (using Live HTTP header on firefox) but the login screen appears after the refresh.
Or, I should set the session using the value in the cookie, shouldn't I?
But what function do I call? I haven't found anything that fits in the WApplication.
Thanks in advance.
RE: session id is shown on the address bar - Added by Koen Deforche about 12 years ago
Hey,
You should also remove the reliance on cookies (this is no longer necessary and also inconvenient since it prohibits different sessions in the same browser). And then either use the setCookie() and getCookie() API in WApplication respectively WEnvironment to save identity across sessions, or use the Wt::Auth framework to do it for you.
Regards,
koen
RE: session id is shown on the address bar - Added by bo bosh about 12 years ago
Thanks a lot! Now it works, although it doesn't remember the tab I am at when refreshing.
RE: session id is shown on the address bar - Added by Koen Deforche about 12 years ago
Hey,
For things like 'the current tab' or the 'the current page', we advise the use of internal paths. WMenu and WTabWidget have standard support for this:
See http://www.webtoolkit.eu/wt/doc/reference/html/classWt_1_1WTabWidget.html#a855b45897b00f82137cd0eb9e0d40dfd
Regards,
koen