session-cookies | 易学教程

servlet set cookie secure?

阅读更多关于 servlet set cookie secure?

问题 javax.servlet.http.Cookie implements java.lang.Cloneable In Cookie method, there is a method call "setSecure" , what does it use for? if i setSecure(true), is there anything i need to do on my client(javascript) side to read the cookie? what is different set/without setSecure? 回答1: All that setSecure(true) does is tell the browser that the cookie should only be sent back to the server if using a "secure" protocol, like https . Your JavaScript code doesn't have to do anything different. 回答2:

Constant Flask Session IDs

阅读更多关于 Constant Flask Session IDs

问题 I've a Flask application, served with Nginx+WSGI (FastCGI & Gevent) and use standard Flask sessions. I do not use the session.permanent=True or any other extra option, but simply set SECRET_KEY in the default configuration. I do not save any (key,value) pairs in the session, and only rely on the SID = session['_id'] entry to identify a returning user. I use the following code the read the SID : @page.route ('/') def main (page='home', template='index.html'): if not request.args.get ('silent',

how do I show a php page just once only per user

阅读更多关于 how do I show a php page just once only per user

问题 Hi I have a php page that I want show it just one time per user. I think this just might be possible with cookies,session-timeout or session-cookies. But I'm not sure. Thanks for your kindness :) 回答1: you answered your own question - by setting a cookie. // check if they've been here, if they haven't set // a cookie for subsequent visits if($_COOKIE['beenhere']) { setcookie("beenhere", '1'); } else { // where you want them to go if they've seen this page header('Location: http://www.example

Prevent session cookie hijacking WITHOUT SSL

阅读更多关于 Prevent session cookie hijacking WITHOUT SSL

问题 To prevent session hijacking, i tried to assign a specific cookie name to each user based on these variables: User-agent and IP Address . I have used following function to generate session cookie name which holds session ID . static function getSessionName(){ $id= @md5(base64_encode(self::$secretToken.$_SERVER["HTTP_USER_AGENT"].$_SERVER["REMOTE_ADDR"])); while(is_numeric($id{0})){ $id = substr($id, 1).$id{0}; } return $id; } It means that every user which visits my website, will have a

PHP user authentication using database and ip address?

阅读更多关于 PHP user authentication using database and ip address?

问题 I have been considering the problems arising with user authentication, using sessions/cookies and the security risks that come up with session hijacking. I understand that using a secure https:// is the most effective method, as well as regenerate_session_id() and using a random string for validation (amongst numerous additional procedures). My question is this: is there a possibility to incorporate a method that forgoes sessions and cookies, and uses just database held variables? Here is how

Session issue in wkhtmltopdf

阅读更多关于 Session issue in wkhtmltopdf

Hi, I am converting HTML to pdf through wkhtmltopdf library, here session is behaving very differently that if we set the session when our link is called then it works fine but our previously set session is not getting? exec('C://"Program Files"//wkhtmltopdf.exe ' . 'http://localhost/test.php?a=351' . ' ' . $file_name . ''); Problem: Session set in test.php is available in this page when printing the page. But if we set the session in some previous page i.e test2.php then that value is null here in test.php Is any idea? Because it's how sessions works, wkhtmltopdf.exe creates another session,

Spring 3 MVC session is lost after external redirect

阅读更多关于 Spring 3 MVC session is lost after external redirect

问题 I have a Spring 3 MVC app and part of the app requires a redirect to a 3rd party payment site and that payment site redirects back to my app after it's done. The problem is that Spring seems to create a new session instead of using the old one and erases all the data previously stored in the session. This creates massive problems for my app and I'm wondering if there is a way to preserve the session after external redirect? Also, cookie are enabled on my browser and I indeed verified that the

Setting HttpOnly=true on ASP 1.1 Session ID cookie

阅读更多关于 Setting HttpOnly=true on ASP 1.1 Session ID cookie

I have a client who runs his Classic ASP site under IIS 6.0. The web site is targeted for ASP.NET 2.0 in the ASP.NET configuration tab. A recent PCI Scan of his site is failing him with an HttpOnly vulnerability on his ASPSESSIONID cookie. I have installed an ISAPI .dll that successfully sets HttpOnly on all manually created cookies, but ASPSESSIONID cookie is not effected by this for some reason. I have set web.config with the following configuration: <system.web> <httpCookies httpOnlyCookies="true" /> </system.web> This configuration seems to have no effect whatsoever, on anything. I suspect

moodle “Can not initialise PHP session, please verify that your browser accepts cookies.”

阅读更多关于 moodle “Can not initialise PHP session, please verify that your browser accepts cookies.”

I'm trying to install MOODLE locally and i face this problem Can not initialize PHP session, please verify that your browser accepts cookies. I'm trying to enable cookie (I'm using chrome) following these steps https://support.google.com/accounts/bin/answer.py?hl=en&answer=61416 and I also tried to config php.ini http://support.qualityunit.com/021373-How-To-Enable-Session-Support-for-PHP but still can't solve it anyone can help me? php configuration <br/> session Session Support enabled Registered save handlers files user Registered serializer handlers php php_binary wddx Directive Local Value

asp.net can you mix cookieless with cookie session stored session data?

阅读更多关于 asp.net can you mix cookieless with cookie session stored session data?

问题 Is it possible to use mixed cookieless sessions with cookie sessions? I've an application that captured user details and then redirect for payment to an ssl page. I was wondering if this is possible? http://www.mydomain.com/confirm.aspx redirects to https://www.mydomain.com/(S(za1tw2l2k02jer4fiskzlovd))/payment.aspx Note: the session Id in the latter url. So in essence, we use the standard cookie session for the majority of the application but when we transfer to an ssl page we pass the