Re[2]: login counter bug?

Hello Chris,

> I think I assumed that the "remember me" did something client side
> (with a cookie perhaps) so that a new session is created each time a
> user accesses netjuke, rather than create an indefinite session. Is
> this common practice?
A session is used for exactly this purpose: ensuring a user's identity
between multiple http accesses. The only difference here is, that in
case of the 'remember me' function there is no timeout for the session
and therefore the user remains logged in. If you would remove the
session you still need some way (cookie<->database) to keep track of
the user's identity for the 'remember me' function.

> It creates a problem from the user accounting side, but does it also
> leave vulnerable a session that can be hijacked?
Netjuke uses a cookie to identify the user (the session). To hijack
the session you would at least need the cookie and I think you also
need the same IP.

> does it also leave httpd procs around indefinitely or is the session
> stored in the db only?
The session is stored in the database (table netjuke_sessions) and a
reference as cookie on the client side. There are no processes running
on the server - that's why we need the session to save the current
state of our application ;-)

Florian <[email protected]>



-------------------------------------------------------
This SF.Net email sponsored by: Parasoft
Error proof Web apps, automate testing & more.
Download & eval WebKing and get a free book.
www.parasoft.com/bulletproofapps1