SESSION (client - server)
nvcnvn
$_SESSION, i' tring to bulid an simple web app with web.go. Can you
tell me abuot session in go!? (like user login or not...)
Thanks you so much!
Andrew Gerrand
surprisingly they don't include a good explanation of how it works. In
short, each user is tagged with a session ID, either by setting a
cookie in their browser or by putting the session ID in each request
URL (eg, http://foo/bar.php?session=ABCD). PHP then stores the
*contents* of $_SESSION in a temporary file or a database somewhere,
and associates it with that ID.
There's no Go library that I'm aware of that provides this
functionality. But it's not too complicated to implement yourself,
provided you know what you want to do.
To set a cookie, you send a Set-Cookie header in your HTTP response.
You'll then be able to read the Cookie header from the user's HTTP
request.
You will need to use the Response.AddHeader method:
http://golang.org/pkg/http/#Response.AddHeader
And access the Request.Header map:
http://golang.org/pkg/http/#Request
Andrew
Devon H. O'Dell
> I just looked up the documentation of PHP's $_SESSION mechanism, and
> surprisingly they don't include a good explanation of how it works. In
> short, each user is tagged with a session ID, either by setting a
> cookie in their browser or by putting the session ID in each request
> URL (eg, http://foo/bar.php?session=ABCD). PHP then stores the
> *contents* of $_SESSION in a temporary file or a database somewhere,
> and associates it with that ID.
For additional clarity, the ID is generated by concatenating the
remote address, current time (tv.tv_sec and tv.tv_usec) and a
pseudorandom number. It then passes this to a hash function (MD5 or
SHA1 or something else). Then it opens an entropy device (e.g.
/dev/urandom) and puts some of that data into the hash function. Then
it finalizes the hash. By default, it stores the data on disk in a
file referenced by the session ID; this can be changed.
> There's no Go library that I'm aware of that provides this
> functionality. But it's not too complicated to implement yourself,
> provided you know what you want to do.
Hopefully the above gives a little more insight as to how it might be
implemented. To my knowledge, there is no logic built in to attempt to
detect hijacking. Sessions are not horribly secure, and generally
shouldn't be used as a token of authentication.
--dho
nvcnvn
call but there is http://download.oracle.com/javaee/1.2.1/api/javax/servlet/http/HttpSession.html)
SESSION like COOKIES but they stored in SERVER not guest browser
For example if you build an log-in systerm, what if:
+Someone can easy fake COOKIES (to log-in with another account by
some how....)
+The guest browser does not allow to store cookies!? <-- this is a big
isuue
The example for SESSION:
1. A guest access a site, there is a form (text box <input type="text"
name="name">) asking there name, he type "Tom" and submit it
2. After submit, in the PHP code:
........................................
........................................
$_SESSION['name'] = $_POST['name'] // $_POST['name'] is an array
item of $_POST array with all the thing was send by the POST method
.......................................
3. After this step, you can always call $_SESSION['name'] and it will
be "Tom" (juslike a cookies) but when user turn of there computer it
will be lost!
So I don't know how to build this function by myseft! This SESSION
help Server reconize client Browser, For example when Tom viewing my
web, Sue does it too! The Application call the $_SESSION['name'] but
it not the same for each Browser on each computer!
P/s: Some on hate PHP in Google App engines but i think this is the
most easy language for web base (just say it easy not powerfull or
security so pleas don't make a language war here! They always do
that!)
> I just looked up the documentation of PHP's $_SESSION mechanism, and
> surprisingly they don't include a good explanation of how it works. In
> short, each user is tagged with a session ID, either by setting a
> cookie in their browser or by putting the session ID in each request
> and associates it with that ID.
>
> There's no Go library that I'm aware of that provides this
> functionality. But it's not too complicated to implement yourself,
> provided you know what you want to do.
>
> To set a cookie, you send a Set-Cookie header in your HTTP response.
> You'll then be able to read the Cookie header from the user's HTTP
> request.
>
> You will need to use the Response.AddHeader method:
> http://golang.org/pkg/http/#Response.AddHeader
> And access the Request.Header map:
> http://golang.org/pkg/http/#Request
>
> Andrew
>
nvcnvn
many (maybe all) web applications in PHP like VBB, phpBB, SMF, Joomla,
Mamboo....or Java App using SESSION when they can not use COOKIES or
even SESSION is the best way for there login systerm rather than
COOKIES.
André Moraes
SESSION usually rely on cookies, like Andrew said a single ID is sent
in a cookie or HTTP Request that identifies the data on the server.
HTTP is stateless, so I order to have some state an ID must be sent in
every request by the client so the server can associate that request
with the previous one.
Session ID by itself is not secure, can be hijacked (read XSRF).
Secure cookies can help but I don't know very much about then.
Using cookies with the Refer header and some other generated Header is
the best way to avoid XSRF. I use a meta tag with an special ID, so
every AJAX request send that ID, if the ID received by the server is
no related with that session ID the request is droped.
In GWT docs the explain a little about how that trick works (I don't
have the link right now).
--
André Moraes
http://andredevchannel.blogspot.com/
nvcnvn
Secure cookies work!?
André Moraes
In that case a sessionid in the QueryString or a Hidden field in the
form will do the trick.
Beside that I don't know any other way to create persistent sessions
Hokapoka
generated psudo-random value that's then HASHed.
Even the PHP based session isn't reliable w/o cookies enabled. I've
seen PHP session state fail where 2 more more machines same LAN that
have cookies blocked - the session was shared across the machines,
this happened to be on an E-commerce application - not what you want.
How do you fix this? As Devon suggested include the time or the
connection, remote IP and then some value that you can be sure is
unique. I've just generated a value from /dev/uranom and checked that
the final value was unique.
For example :
f _ := os.Open("/dev/urandom", os.O_RDONLY,
0)
b := make([]byte, 16)
f.Read(b)
f.Close()
Where there's no cookies you need to inc. the generated value in the
params passed to/from the client.
There's another, less reliable, option that could be used as a fail
back for cookieless clients if you don't want to pass around the
session ID in the params. If you inc. the UserAgent along with the IP
address, when generating the Session Id, my tests (some 5/6 years ago
showed this to be more reliable than PHP's Session ID, but that just
pushed the reliance to the UserAgent, it's not failsafe.
Benny Siegert
> How do you fix this? As Devon suggested include the time or the
> connection, remote IP and then some value that you can be sure is
> unique. I've just generated a value from /dev/uranom and checked that
> the final value was unique.
Including the remote IP breaks for some users with load-balancing
proxies. In such a setup, the HTTP requests can legitimately come from
a different IP address each time.
--Benny.