Re: login counter bug?

I think I assumed that the "remember me" did something client side 
(with a cookie perhaps) so that a new session is created each time a 
user accesses netjuke, rather than create an indefinite session. Is 
this common practice?

It creates a problem from the user accounting side, but does it also 
leave vulnerable a session that can be hijacked? does it also leave 
httpd procs around indefinitely or is the session stored in the db only?

thanks-

chris

On Monday, July 14, 2003, at 03:32  PM, Florian Maul wrote:

> Hallo Chris,
>
>> So I explicitly logged out and logged back in, and the login count
>> was incremented and the date updated. Apparently, if a user has
>> "remember me" checked when they log in, future connections are not
>> tracked as "logins".
> The logins are counted whenever the session in the database is
> created. When 'remember me' me is activated the session entry in the
> database is not deleted and the same session will be used for all
> future transactions with netjuke, if I'm not mistaken.
>
> I'm not completely aware of the session management but I think it's
> not that easy to determine when to count your netjuke access as a
> login when you never explicitly log out, since the current session
> lives forever.
>
> You are suggesting to count a new login when a certain time since the
> last page access has been reached, aren't you?
>
> Florian <[email protected]>
>



-------------------------------------------------------
This SF.Net email sponsored by: Parasoft
Error proof Web apps, automate testing & more.
Download & eval WebKing and get a free book.
www.parasoft.com/bulletproofapps1