Re: ERAttachmentLink and sessions
Robin Smith <[email protected]>
| Newsgroups | gmane.comp.web.webobjects.wonder-disc |
|---|---|
| Message-ID | <CAHmZkDtoGS-Shffc84n4gx5x_fjJnO5f=L=T2uoMDDjFw3OeWg@mail.gmail.com> |
Hi Jesse I think we may talking about different things ERAttachmentLink is used to create a hyperlink on your page to download ERAttachments in our case from s3. Put simply the url that the link creates doesn't include the session id. Many Thanks Robin On 9 January 2013 23:39, Jesse Tayler <[email protected]> wrote: > > well, me thinks file upload is done without a session that way because uploading files takes a long time and can cause session timeouts on its own. > > is that what you mean? > > as for your security issue? I am not certain why you loose visibility about who is logged in? certainly you should be able to do this in a reasonably secure way so I don't entirely follow what is going on there. > > On Jan 9, 2013, at 12:43 PM, Robin Smith <[email protected]> wrote: > >> Hi All >> >> We question regarding ERAttachmentLink, following the code through it >> seems that it doesn't preserve the session when it creates the links. >> The reason this is important is that using a custom handler to check >> that our currently logged in user can access the given attachment we >> lose all visibility of who is actually logged in. >> >> If the app is using cookies for its sessions all is fine as the >> session is retrieved from the cookie, but if the session is in the url >> then it all breaks down. I can obviously tweak ERAttachmentLink to >> preserve the session if needed but before i started i wanted to know >> if there is any reason why it was done in this way. >> >> Many Thanks >> >> Robin >> >> -- >> >> ------------------------------ >> Click Travel Ltd >> Taking business travel and expenses one step further >> http://www.clicktravel.com >> >> Winner of "Best Business Travel Management Company" at the Business Travel >> Awards (2012 & 2009) and the Travel Trade Gazette Awards (2011). We're also ranked >> 22nd in the 2012 Sunday Times Hiscox Tech Track 100. >> >> For all the latest Click news please visit our blog: >> http://clicktravel.com/blog >> >> Think: Do you really need to print this email? >> >> ------------------------------------------------------------------------------ >> Master Java SE, Java EE, Eclipse, Spring, Hibernate, JavaScript, jQuery >> and much more. Keep your Java skills current with LearnJavaNow - >> 200+ hours of step-by-step video tutorials by Java experts. >> SALE $49.99 this month only -- learn more at: >> http://p.sf.net/sfu/learnmore_122612 >> _______________________________________________ >> Wonder-disc mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/wonder-disc > -- Robin Smith Engineering Team Leader BEng (Hons) MBCS -- ------------------------------ Click Travel Ltd Taking business travel and expenses one step further http://www.clicktravel.com Winner of "Best Business Travel Management Company" at the Business Travel Awards (2012 & 2009) and the Travel Trade Gazette Awards (2011). We're also ranked 22nd in the 2012 Sunday Times Hiscox Tech Track 100. For all the latest Click news please visit our blog: http://clicktravel.com/blog Think: Do you really need to print this email? ------------------------------------------------------------------------------ Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS, MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft MVPs and experts. ON SALE this month only -- learn more at: http://p.sf.net/sfu/learnmore_122712