session-cookies | 易学教程

Remember me Cookie best practice?

阅读更多关于 Remember me Cookie best practice?

I read about many old questions about this argument, and I thought that the best practice is to set up a cookie with username , user_id and a random token. Same cookie's data is stored in DB at cookie creation, and when users have the cookie they are compared (cookie data, DB data). Sincerely I can't understand where is the security logic if this is the real best practice. An attacker who steals the cookie has the same cookie than the original user :| Forgotten some step? :P You should store the user_id and issue a random token in addition to the user's password. Use the token in the cookie

Android session management

阅读更多关于 Android session management

Is there a specific library for Android session management? I need to manage my sessions in a normal Android app. not in WebView . I can set the session from my post method. But when I send another request that session is lost. Can someone help me with this matter? DefaultHttpClient httpClient = new DefaultHttpClient(); HttpPost httppost = new HttpPost("My url"); HttpResponse response = httpClient.execute(httppost); List<Cookie> cookies = httpClient.getCookieStore().getCookies(); if (cookies.isEmpty()) { System.out.println("None"); } else { for (int i = 0; i < cookies.size(); i++) { System.out

Why do some Flask session values disappear from the session after closing the browser window, but then reappear later without me adding them?

阅读更多关于 Why do some Flask session values disappear from the session after closing the browser window, but then reappear later without me adding them?

问题 So my understanding of Flask sessions is that I can use it like a dictionary and add values to a session by doing: session['key name'] = 'some value here' And that works fine. On a route I have the client call using AJAX post, I assign a value to the session. And it works fine. I can click on various pages of my site and the value stays in the session. If I close the browser window however, and then go back to my site, the session value I had in there is gone. So that's weird and you would

PHP authentication with multiple domains and subdomains

阅读更多关于 PHP authentication with multiple domains and subdomains

I have one main domain: main.com , subdomains: test1.main.com , test2.main.com and other domains one.com , two.com . Now it's done like these: ini_set("session.cookie_domain", ".main.com"); $domain = 'main.com'; login.php $user = $db->query("SELECT id, login FROM users WHERE email=? AND password=?", array($email, $password), "rowassoc"); if($user) { $_SESSION['user_id'] = $user['id']; $_SESSION['user_name'] = $user['login']; $time = 100000; setcookie('email', $email, time() + $time, "/", "." . $domain); setcookie('password', $password, time() + $time, "/", "." . $domain); header('Location:

Session is lost after an OAuth redirect

阅读更多关于 Session is lost after an OAuth redirect

问题 I use CakePHP 2.4. I have an OAuth signin in my website. %99.5 of signins are successfull but %0.5 fails. I have this error for months. I tried many things to debug and log but still I didn't solve the problem. Although most of the requests are good I need to solve the small part. Scenario is like this: User clicks Sign in button I get request token from server (for example yahoo, twitter) I save oauth_token in user's session for example session ID is aaa1234 CakePHP creates PHPSESSID cookie

How do you view session cookies in Internet Explorer?

阅读更多关于 How do you view session cookies in Internet Explorer?

问题 I am able to see session cookies in Firefox 3.6 by going to Tools->Options->Privacy->Remove Individual Cookies How do I see those same session cookies in IE (6/7/8)? Tools->Internet Options->Browsing history Settings->View files only contains persistent cookies Also how do I access them programmatically? In Firefox I use the nsICookieManager interface to read the session cookies, does IE contain an equivalent interface? 回答1: Cookies set with the HTTPOnly attribute will not be visible to

Set httpOnly and secure on PHPSESSID cookie in PHP

阅读更多关于 Set httpOnly and secure on PHPSESSID cookie in PHP

问题 Whats the recommended way to set httponly and secure flags on the PHPSESSID cookie? I found http://www.php.net/manual/en/session.configuration.php#ini.session.cookie-httponly. Any better suggestions? thanks 回答1: In my opinion the best would be: http://www.php.net/manual/en/function.session-set-cookie-params.php void session_set_cookie_params ( int $lifetime [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false ]]]] ) 回答2: ini_set('session.cookie_httponly', 1);

PHP - why can't I get rid of this session id cookie?

阅读更多关于 PHP - why can't I get rid of this session id cookie?

问题 I'm trying to troubleshoot a logout function for a web app. When you're logged in, the app has several cookies set for its domain. Here's the current logout procedure: You click a link, which sends you to a logout page The logout page runs a function that calls session_destroy() and also loops through all the cookies for the domain and sets them to expire in the past (see code below) The logout page then redirects to a login page, which is straight HTML. At the end of this process, all the

How to add a cookie to the cookiejar in python requests library

阅读更多关于 How to add a cookie to the cookiejar in python requests library

问题 I am trying to add a cookie to an existing cookiejar using the python requests 1.2.3 library. Every time I add the new cookie, the data in the jar is munged for the new cookie. Keys missing, Values missing or matched to incorrect Keys. I'm not sure if it's a Request library bug or I'm not sending the cookie correctly. I'm using the following code that is resulting in a bad cookie in cookiejar. Am I formatting the cookie correctly? Any ideas? my_cookie = { 'domain':'www.mydomain.com', 'expires

HttpContext.Current.Session is null in MVC 3 application

阅读更多关于 HttpContext.Current.Session is null in MVC 3 application

问题 I have a bilingual MVC 3 application, I use cookies and session to save "Culture" in Session_start method inside Global.aspx.cs file, but direct after it, the session is null. This is my code: protected void Session_Start(object sender, EventArgs e) { HttpCookie aCookie = Request.Cookies["MyData"]; if (aCookie == null) { Session["MyCulture"] = "de-DE"; aCookie = new HttpCookie("MyData"); //aCookie.Value = Convert.ToString(Session["MyCulture"]); aCookie["MyLang"] = "de-DE"; aCookie.Expires =