This link has been bookmarked by 9 people . It was first bookmarked on 16 Apr 2008, by Daniel Andrlik.
-
29 Dec 09
Ivari HormHow many times have you returned to your web browser to be greeted by this unpleasant little notification:
Your session has timed out. Please sign in again.-
- Performance. Consider a highly trafficked web site. If the website tried to keep sessions alive for an entire month, that could cause the session table to grow to millions of records. It's even worse if you think about it in terms of user information cached in memory; a measly few kilobytes of memory state per user doesn't sound like much, but multiplied by a few million, it absolutely is. If this data wasn't expired and dumped on some schedule, it would quickly blow up the web server.
- Security. The magic cookie that stores your session can potentially be stolen. If that cookie never expires, you have an infinitely long vulnerability window to session hijacking. This is serious stuff, and mitigation strategies are limited. The best option, short of encrypting the entire connection from end to end via HTTPS, is to keep a tight expiration window on the session cookie, and regenerate them frequently.
So why does the server choose to arbitrarily forget about you in an hour?
-
- Create a background JavaScript process in the browser that sends regular heartbeats to the server. Regenerate a new cookie with timed expiration, say, every 5 or 10 minutes.
- If you're worried about session hijacking -- and you really should be -- use a HTTPS protected connection. This is an absolute no-brainer for financial institutions of any kind.
Here's what I suggest:
-
-
21 Apr 08
-
18 Apr 08
-
17 Apr 08
-
16 Apr 08
-
Daniel AndrlikThis is an interesting post by Jeff Atwood on how programmers should handle session expiration in their applications. I particularly like his explanation of why session expiration occurs:
"The HTTP protocol that the web is built on is stateless. That means every individual request your browser sends to a web server is a newborn babe, cruelly born into a world that is utterly and completely oblivious to its existence." :-)-
The HTTP protocol that the web is built on is stateless. That means every individual request your browser sends to a web server is a newborn babe, cruelly born into a world that is utterly and completely oblivious to its existence.
-
Would you like to comment?
Join Diigo for a free account, or sign in if you are already a member.