Re: [cgiapp] Restrict access to certain run modes

[Barry Moore <suppressed>]

Thanks alot for the tips Cees.  Much appreciated.  I was thinking about 
this authentication issue on the way home last night, and another issue 
came to mind.  Let's say you want to have your session data stay valid 
for quite a while - weeks or months, so that you don't lose your user's 
profile, or anything they might have stashed in a cart, so you set 
expiration of the session to 3 months.  You want to expire their login 
flag after only 15 minutes of inactivity, so you set that parameters 
expiration seperately to 15 minutes.  You also have a log out link so 
that wise users can end their session on public machines as soon as 
their finish with your site.  However, what about the person who just 
closes the browser asssuming that they have then logged out - that's 
what I always assumed.  If the cookie has no expiration set then it's my 
understanding that it goes away when the browser closes right?  But we 
don't want the cookie to go away entirely because we want to meet and 
greet next time our user comes back.  So my cookie is still there, my 
session login in flag has 15 minutes left.  What if someone comes to 
that computer, restarts the browser, and goes to my site.  Won't they be 
logged in as the user who just left?

So my dilema is this:  Sessions and individual pieces of session data 
can have independent expiration times, but it seems that cookies are all 
or nothing.  You can't have an individual parameter of a cookie expire 
independently of the rest of the cookie can you? I want to have a fairly 
persistent cookie so that I'll remember my user for some time, but I 
want the login flag to die based either on time or on browser shutdown.  
Does that need to involve two seperate cookies - one for user 
identification with a persistent expiration that is associated with 
server side session data and session based login flag, and another 
cookie that tracks another login flag and dies on browser shutdown.  
Then I would end up with something like.  User comes to site.  A 3 month 
persistent cookie identifies them to me, and I greet with customized 
login page.  User logs in, and I retrieve profile, cart etc. from 
database.  User's session is set to expire in 3 months, their login flag 
is turned on and set to expire in 15 minutes.   A new cookie with no 
expiration set (so that it expires when the browser closes) is set as a 
second login flag.  Now during the session both my server side login 
flag, and my expiring-on-shutdown cookie are required for run mode 
authentication.  If the brower shuts down the cookie expires and the 
user has to re-login.  If the browser stays open, but is inactive for 15 
minutes then the session flag expires, and the user has to re-login.  Am 
I on track here, or are there easier ways to do this?

Barry

Cees Hek wrote:

> On 8/16/05, Barry Moore <suppressed> wrote:
>  
>
> > If you're on Windows or something else without /tmp edit the line 16 of
> > the cgiapp module to something like this:
> > CGI_SESSION_OPTIONS => ["driver:File", $self->query, {Directory =>
> > "C:\\"}],
> >    
>
> I know this doesn't have anything to do with what your are writing
> about, but I thought I'd throw out a little helpful hint for
> portability sake.  If you want to make this work on all systems, use
> the File::Spec library (comes standard with perl), and look for the
> tmpdir method.  It will return a valid temporary directory for the
> platform that you are running on.
>
> File::Spec->tmpdir
>
> And interestingly enough, the options for
> CGI::Application::Plugin::Session that you are using in your code are
> actually the same as the defaults it provides (except that the plugin
> uses the File::Spec->tmpdir method to figure out the temporary
> directory).  So you could have just configured your session like this:
>
> $self->session_config(
>    COOKIE_PARAMS     => {-expires => '+24h',},
>    SEND_COOKIE         => 1
> );
>
> And since the latest release, CGI::Application::Plugin::Session can
> automatically set the expiry date on the session for you, which then
> also adds the same expiry date to the outgoing cookie.  So you could
> use the DEFAULT_EXPIRY option instead of the COOKIE_PARAMS method. 
> And SEND_COOKIE is on by default so you don't need it either :)
>
> $self->session_config(
>    DEFAULT_EXPIRY => '+24h',
> );
>
> That will create file based sessions in a temp dir consistent with the
> platform you are running on, and it will set all new sessions to
> expire in 24 hours, and automatically send a cookie that also expires
> in 24 hours.
>
> Cheers,
>
> Cees
>
> ps for what it is worth, I do authentication in a very similar way as
> in your code, except that I do the authentication through
> CGI::Session::Auth (for now).  But the structure (doing the checks in
> prerun, etc...) is very similar.  There, that brings us back on topic
> ;)
>  

--
Barry Moore
Dept. of Human Genetics
University of Utah
Salt Lake City, UT