Session Management: NO Cookies....

[Sucpraran]

New to Perl, Apache world.
Like to get thoughts on maintaining session WITHOUT using Client Side
Cookies.
Our environment is Perl, Apache, Oracle DB, Unix OS.

What are the capabilities of Server side/Database session management
in this environment? We can't compromise on security and load
balancing (multiple servers).

Thanks

 

[James Willmore]

New to Perl, Apache world.
Like to get thoughts on maintaining session WITHOUT using Client Side
Cookies.
Our environment is Perl, Apache, Oracle DB, Unix OS.

What are the capabilities of Server side/Database session management
in this environment? We can't compromise on security and load
balancing (multiple servers).

You could use hidden fields, but that's not a 100% secure method. Or
an Apache module (think mod_auth), but I believe that uses cookies.
You could restrict access based upon IP addresses, but those can be
spoofed.

Any reason why you don't want to use cookies? I mean, if you _only_
use cookies, that's not very secure. However, they are useful when
used in conjunction with other methods. It's just another layer of
authentication that someone has to figure out, but it's still a layer.
It keeps honest people honest.

HTH

Jim

 

[Keith Keller]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message

Like to get thoughts on maintaining session WITHOUT using Client Side
Cookies.

You might want to be more specific on what you mean by a session--
there are lots of techniques, but not all applicable to every
situation.

Also, comp.infosystems.www.authoring.cgi or the mod_perl list
might be a better place for your question, since there will be
many methods that are not perl-specific. (Most, really.)

--keith

--
(e-mail address removed)-francisco.ca.us
(try just my userid to email me)
AOLSFAQ=http://wombat.san-francisco.ca.us/cgi-bin/fom

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAj9xIKgACgkQhVcNCxZ5ID9sJwCdFod5UP4utpzlEXfhCsUCw9/Z
ij4Anjht445LcPGoY7co14mPOb65VDps
=52Rp
-----END PGP SIGNATURE-----

 

[Bill]

New to Perl, Apache world.
Like to get thoughts on maintaining session WITHOUT using Client Side
Cookies.
Our environment is Perl, Apache, Oracle DB, Unix OS.

What are the capabilities of Server side/Database session management
in this environment? We can't compromise on security and load
balancing (multiple servers).

Thanks

Have a look at SOAP (this is usable by Perl but is not language dependent):

http://www.perl.com/pub/a/2001/04/24/soap.html