From: Kirk Haines <khaines@...>
Date: 2004-05-08T09:45:28+09:00
Subject: Re: What is Borges?

On Sat, 8 May 2004 09:16:49 +0900, Carl Youngblood wrote

> You are probably aware of this, but putting session IDs in URLs can 
> make it easier to hijack sessions.  Here is a good article that 
> explains some of the things to consider when designing a session 
> manager (it's for PHP but the principles are universal): 
> http://www.sitepoint.com/blog-post-view.php?id=156260&ct=1
> 
> Particularly, it is important to make sure that any external links 
> don't get the session appended to them, or other internet servers 
> will see them.

Iowa and Seaside/Borges both handle this in basically the same way.

Application URLs look something like this (for Iowa):

http://somehost.com/guestbook/11131dab-105c6c68-abNmbFaYA5gFE.a.1.7

The random looking gobbledeygook at the end is the session id.  It is unique 
over a pretty large space of possible ids, so should be hard to guess.  A 
similar sort of thing holds true for Borges/Seaside.

These application URLs get generated by the framework automatically, and 
right now I can't even think of a way to get that session ID tacked onto a 
URL that points to someplace outside of the application.

One of my reasons for planning on adding a mechanism to store this id in a 
cookie, though, is because it is pretty ugly.  There are cases where I would 
prefer to not have that stuff showing up on the URL line in the browser and 
where using a cookie for it would not be a problem.

> The advantage of using another backend for sessioning is that a 
> webserver can fail or be rebooted/replaced without any users being 
> affected by it.  They will transparently be sent to a different 
> webserver by the hardware load balancer and their session will 
> remain intact.

Yep.  And that would be a cool feature.  For Borges, though, I think this 
would be pretty difficult because it is continuation based.  To truly 
serialize and reconstruct the session seems to me like it would be quite a 
difficult and impressive task.

For Iowa the bar isn't quite so high since sessions and the page trail for 
each session are all objects.  It's probably possible to do it for Iowa 
without too much overt difficulty.  However, it still seems like it would be 
a pretty expensive task in terms of processing and time usage, and for most 
things, most of the time, probably isn't worth it.  It's something that I 
have been thinking about off and on for probably two years but it's just 
never been something that I needed enough to spend the time on it.


Kirk Haines