September 2016 - Pharo-users

Re: [Pharo-users] Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by Petr Fischer

> Mariano, > > this would be a perfect article for your blog (hint, hint) and I'd be > one of the first and excited readers. I must admit I sometimes am > frightened by all the filters and whatnot that I could be using for > certain tasks. I always feel like I miss half of what the power of > Seaside is because there is no documentation or tutorias on all that > stuff (or are there????) Exactly! There is some documentiation on the net, but documentation is often obsolete - even official documentation (book.seaside.st for example). Blog post is nice and welcome, but blogs and blog systems die sometimes and then what? Also there is some article/blog post for very old Seaside, another article for pre-actual Seaside and no article for actual Seaside... Central point (under pharo.org) for all the valid actual knowledge resources is necessary (IMHO). > So it would be great if you could not only share your code but also > explain it a little bit, for dummies like me... > > Joachim > >

Sept. 22, 2016

Re: [Pharo-users] Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by Petr Fischer

> > > Hello, two questions about Seaside sessions: > > > > > > 1) URL sharing between different users - what if "boss" shares URL from > > his browser and send it to another regular user - of course, easy way, > > whole URL with session (_s=xxxx) - when another/regular user opens that > > link -> whole "boss" session opens in regular user's browser, with all > > "boss" permissions, UI state etc etc - very bad, is there any solution for > > this? Rewrite every (!) URL with updateURL: is not solution :( > > > > If this is a concern, you can use a cookie for session tracking, but that > > means you cannot have multiple Seaside sessions running in the same browser > > at the same time. > > > > There are probably other ways, but I think the solution is not to rely on > > a session key for authentication. > > Hereâs a strategy: > > Keep the Seaside session key in the url for session tracking but use an > > authorization cookie for authorization. Put that cookie when the user logs > > in and check its presence when requests come in for a session. > > I think that using a filter for that is a good choice. > > > > Whenever another user copy/pastes the url, he cannot âhijackâ the session > > because he lacks the correct authentication cookie. > > > > > That's exactly what I did in my case. And the way to implement that was > with a custom session tracker that dealt with the cookie plus a filter for > the checking and kickout. > > I can share this if someone wants it (I think I already shared it before) Other beginners with Pharo/Seaside might appreciate if it was standard part of Seaside. In standard Seaside package, there is for example class WAIPSessionTrackingStrategy, it's nice as example, but unusable in real world. Your session tracking strategy is definitely more useful - can you share? Can you share with Seaside developers? :) > > > 2) What is the actual way for "session expiration/login page"? There is > > few tutorials and books on the inet - but info about session expiration is > > obsolete :( Methods from tutorials not exists in Seaside 3.2.0. > > > Some trick with WAApplication subclass is actual? > > > > Iâm not sure what the question is. Do you want to redirect users to a page > > whenever the session is expired? > > > > cheers > > Johan > > > -- > Mariano > http://marianopeck.wordpress.com

Sept. 21, 2016

Re: [Pharo-users] Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by Petr Fischer

> > Hello, two questions about Seaside sessions: > > > > 1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :( > > If this is a concern, you can use a cookie for session tracking, but that means you cannot have multiple Seaside sessions running in the same browser at the same time. > > There are probably other ways, but I think the solution is not to rely on a session key for authentication. > Hereâs a strategy: > Keep the Seaside session key in the url for session tracking but use an authorization cookie for authorization. Put that cookie when the user logs in and check its presence when requests come in for a session. > I think that using a filter for that is a good choice. > > Whenever another user copy/pastes the url, he cannot âhijackâ the session because he lacks the correct authentication cookie. This sounds reasonable. Thanks. > > > 2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. > > Some trick with WAApplication subclass is actual? > > Iâm not sure what the question is. Do you want to redirect users to a page whenever the session is expired? Yes, just ordinary redirect to login page, with proper expiration notice (when session is expired). Another question is, how to handle session expiration inside AJAX call (also with proper redirect to login page with expiration notice) - this is harder - there is some solutions, like "ping" from web browser to Seaside server, so the session never expires, but this is in conflict with my/common needs (I want session timeout with auto logouts). > cheers > Johan

Sept. 21, 2016

Re: [Pharo-users] Pharo not running with macOS Sierra

by JupiterJones

Starting from the cmdline I get the following output - which I guess is correct since none of the listed PlugIns are in that path :) But they weren't in the path before the update either. I had no lock with the linked VM either - same result as you. ./pharo-ui Pharo.image 2016-09-22 09:22:05.231 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/LocalePlugin' 2016-09-22 09:22:05.232 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/LargeIntegers' 2016-09-22 09:22:05.232 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/LargeIntegers' 2016-09-22 09:22:05.233 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/LargeIntegers' 2016-09-22 09:22:05.434 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/UUIDPlugin' 2016-09-22 09:22:05.434 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/MiscPrimitivePlugin' 2016-09-22 09:22:05.435 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/MiscPrimitivePlugin' 2016-09-22 09:22:05.435 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/MiscPrimitivePlugin' 2016-09-22 09:22:05.435 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/FilePlugin' 2016-09-22 09:22:05.436 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/LargeIntegers' 2016-09-22 09:22:05.436 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/LargeIntegers' 2016-09-22 09:22:05.437 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/LargeIntegers' 2016-09-22 09:22:05.437 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/LargeIntegers' 2016-09-22 09:22:05.446 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/MiscPrimitivePlugin' 2016-09-22 09:22:05.447 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/MiscPrimitivePlugin' 2016-09-22 09:22:05.448 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/MiscPrimitivePlugin' 2016-09-22 09:22:05.449 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/FilePlugin' 2016-09-22 09:22:05.759 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/SqueakFFIPrims' 2016-09-22 09:22:05.759 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/SqueakFFIPrims' 2016-09-22 09:22:05.760 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/FilePlugin' 2016-09-22 09:22:05.760 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/FilePlugin' 2016-09-22 09:22:09.517 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/LargeIntegers' 2016-09-22 09:22:12.541 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/FilePlugin' 2016-09-22 09:22:12.542 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/InternetConfigPlugin' 2016-09-22 09:22:12.582 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/FT2Plugin' 2016-09-22 09:22:12.585 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/MiscPrimitivePlugin' 2016-09-22 09:22:12.589 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/BitBltPlugin' 2016-09-22 09:22:12.589 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/BitBltPlugin' 2016-09-22 09:22:12.609 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/LargeIntegers' 2016-09-22 09:22:12.766 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/FilePlugin' 2016-09-22 09:22:12.821 Pharo[48644:843238] *** -[NSPathStore2 stringByAppendingPathExtension:]: cannot append extension 'bundle/Contents/MacOS/' to path '/opt/pharo5/sep2016dev/pharo-vm/Pharo.app/Contents/MacOS/Plugins/SocketPlugin' -- View this message in context: http://forum.world.st/Pharo-not-running-with-macOS-Sierra-tp4916468p4916540… Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

Sept. 21, 2016

Re: [Pharo-users] GLMPanePort hold instances of my classes?

by Bernardo Ezequiel Contreras

sorry, no, i can't reproduce it. thanks On Wed, Sep 21, 2016 at 4:22 PM, Tudor Girba <tudor(a)tudorgirba.com> wrote: > Hi, > > No, this was not at all a stupid question. It might be that we have a > memory leak. > > Could you reproduce the problem? > > Cheers, > Doru > > > On Sep 21, 2016, at 4:34 PM, Bernardo Ezequiel Contreras < > vonbecmann(a)gmail.com> wrote: > > > > everything was closed, i was using the simple workspace. but anyways > there were references. > > > > it was a stupid question, i solved it starting from a fresh image. > > > > thanks > > > > On Wed, Sep 21, 2016 at 1:16 AM, Tudor Girba <tudor(a)tudorgirba.com> > wrote: > > Hi, > > > > You should close the respective Glamour browser. Could it be that you > have an opened inspector? If so, try closing it and see what happens. > > > > Doru > > > > > > > On Sep 21, 2016, at 3:28 AM, Bernardo Ezequiel Contreras < > vonbecmann(a)gmail.com> wrote: > > > > > > Hi, > > > is there a way to tell to GLMPanePort to release my stupid objects > and classes? > > > because i want to change a class and i can't. there's another bug when > migrating > > > instances (not easy to reproduce). so im trying to release all the > references. > > > is it possible?? > > > > > > thanks. > > > > > > example: > > > Port (pane=#evaluator name=#entity value=([A = A, AÂ·. @ [45, 127]])) > > > Port (pane='root' name=#selection value=([A = A, AÂ·. @ [45, 127]])) > > > JEPackedNode(ProtoObject)>>gtInspectorActionBrowse > > > [ :aPresentation | each gtInspectorActions asOrderedCollection ] > > > etc. > > > > > > > > > Image > > > ----- > > > Pharo5.0 > > > Latest update: #50761 > > > Unnamed > > > > > > Virtual Machine > > > --------------- > > > CoInterpreter VMMaker.oscog-HolgerHansPeterFreyther.1880 uuid: > 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > > StackToRegisterMappingCogit VMMaker.oscog-HolgerHansPeterFreyther.1880 > uuid: 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > > https://github.com/pharo-project/pharo-vm.git Commit: > 3daf6cb181c8332cf6993b07430e0d5f0886fda9 Date: 2016-07-16 18:01:23 +0200 > By: GitHub <noreply(a)github.com> Jenkins build #597 > > > > > > Unix built on Jul 18 2016 16:36:31 Compiler: 4.6.3 > > > VMMaker versionString https://github.com/pharo-project/pharo-vm.git > Commit: 3daf6cb181c8332cf6993b07430e0d5f0886fda9 Date: 2016-07-16 > 18:01:23 +0200 By: GitHub <noreply(a)github.com> Jenkins build #597 > > > CoInterpreter VMMaker.oscog-HolgerHansPeterFreyther.1880 uuid: > 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > > StackToRegisterMappingCogit VMMaker.oscog-HolgerHansPeterFreyther.1880 > uuid: 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > > > > > > > > > > > -- > > > Bernardo E.C. > > > > > > Sent from a cheap desktop computer in South America. > > > > -- > > www.tudorgirba.com > > www.feenk.com > > > > "Every thing has its own flow." > > > > > > > > > > > > > > > > > > > > -- > > Bernardo E.C. > > > > Sent from a cheap desktop computer in South America. > > -- > www.tudorgirba.com > www.feenk.com > > âThe smaller and more pervasive the hardware becomes, the more physical > the software gets." > > > -- Bernardo E.C. Sent from a cheap desktop computer in South America.

Sept. 21, 2016

Re: [Pharo-users] GLMPanePort hold instances of my classes?

by Tudor Girba

Hi, No, this was not at all a stupid question. It might be that we have a memory leak. Could you reproduce the problem? Cheers, Doru > On Sep 21, 2016, at 4:34 PM, Bernardo Ezequiel Contreras <vonbecmann(a)gmail.com> wrote: > > everything was closed, i was using the simple workspace. but anyways there were references. > > it was a stupid question, i solved it starting from a fresh image. > > thanks > > On Wed, Sep 21, 2016 at 1:16 AM, Tudor Girba <tudor(a)tudorgirba.com> wrote: > Hi, > > You should close the respective Glamour browser. Could it be that you have an opened inspector? If so, try closing it and see what happens. > > Doru > > > > On Sep 21, 2016, at 3:28 AM, Bernardo Ezequiel Contreras <vonbecmann(a)gmail.com> wrote: > > > > Hi, > > is there a way to tell to GLMPanePort to release my stupid objects and classes? > > because i want to change a class and i can't. there's another bug when migrating > > instances (not easy to reproduce). so im trying to release all the references. > > is it possible?? > > > > thanks. > > > > example: > > Port (pane=#evaluator name=#entity value=([A = A, AÂ·. @ [45, 127]])) > > Port (pane='root' name=#selection value=([A = A, AÂ·. @ [45, 127]])) > > JEPackedNode(ProtoObject)>>gtInspectorActionBrowse > > [ :aPresentation | each gtInspectorActions asOrderedCollection ] > > etc. > > > > > > Image > > ----- > > Pharo5.0 > > Latest update: #50761 > > Unnamed > > > > Virtual Machine > > --------------- > > CoInterpreter VMMaker.oscog-HolgerHansPeterFreyther.1880 uuid: 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > StackToRegisterMappingCogit VMMaker.oscog-HolgerHansPeterFreyther.1880 uuid: 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > https://github.com/pharo-project/pharo-vm.git Commit: 3daf6cb181c8332cf6993b07430e0d5f0886fda9 Date: 2016-07-16 18:01:23 +0200 By: GitHub <noreply(a)github.com> Jenkins build #597 > > > > Unix built on Jul 18 2016 16:36:31 Compiler: 4.6.3 > > VMMaker versionString https://github.com/pharo-project/pharo-vm.git Commit: 3daf6cb181c8332cf6993b07430e0d5f0886fda9 Date: 2016-07-16 18:01:23 +0200 By: GitHub <noreply(a)github.com> Jenkins build #597 > > CoInterpreter VMMaker.oscog-HolgerHansPeterFreyther.1880 uuid: 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > StackToRegisterMappingCogit VMMaker.oscog-HolgerHansPeterFreyther.1880 uuid: 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > > > > > > > -- > > Bernardo E.C. > > > > Sent from a cheap desktop computer in South America. > > -- > www.tudorgirba.com > www.feenk.com > > "Every thing has its own flow." > > > > > > > > > > -- > Bernardo E.C. > > Sent from a cheap desktop computer in South America. -- www.tudorgirba.com www.feenk.com âThe smaller and more pervasive the hardware becomes, the more physical the software gets."

Sept. 21, 2016

Re: [Pharo-users] Pharo not running with macOS Sierra

by vivus-ignis

Martin, which image were you using? The "unofficial" VM from the link presents a dialog to open a file and once I select an image, it just disappears and nothing happens after that. -- View this message in context: http://forum.world.st/Pharo-not-running-with-macOS-Sierra-tp4916468p4916529… Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

Sept. 21, 2016

Re: [Pharo-users] doesNotUnderstand: infinit loop

by Hilaire

Hi Guille, I was wondering if I could have kill manually this process, but the process browser does not let you do that mistake. Thanks for the tip. Hilaire Le 21/09/2016 Ã 12:11, Guille Polito a Ã©crit : > Hi Hilaire, all, > > I started digging this morning on this issue, and I see why we can have > such problems. > > Apparently, there is some strange case that produces a bug in UIManager. > To explain it with code, the UIManager should satisfy allways the > following invariant. > > "If executed from a workspace/playground. i.e., the UI process itself:" > UIManager default uiProcess == Processor activeProcess. => true > > Somehow, in the image you provided me, it is not the case. > > I'm still taking a look at what would cause this. And I also think we > still have this bug in pharo 6 (and thus pharo 5) because I found it > lately very often. > > In the meantime, if you find that your image is causing you these > problems, you can workaround it by executing: > > UIManager default spawnNewProcess. > > Once you do that, the ui process should come back to a correct state and > the debugger should behave as expected. > > Guille -- Dr. Geo http://drgeo.eu

Sept. 21, 2016

Re: [Pharo-users] Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by jtuchel＠objektfabrik.de

Mariano, this would be a perfect article for your blog (hint, hint) and I'd be one of the first and excited readers. I must admit I sometimes am frightened by all the filters and whatnot that I could be using for certain tasks. I always feel like I miss half of what the power of Seaside is because there is no documentation or tutorias on all that stuff (or are there????) So it would be great if you could not only share your code but also explain it a little bit, for dummies like me... Joachim

Sept. 21, 2016

Re: [Pharo-users] Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by Mariano Martinez Peck

On Wed, Sep 21, 2016 at 11:50 AM, Johan Brichau <johan(a)inceptive.be> wrote: > > > On 21 Sep 2016, at 12:31, Petr Fischer <petr.fischer(a)me.com> wrote: > > > > Hello, two questions about Seaside sessions: > > > > 1) URL sharing between different users - what if "boss" shares URL from > his browser and send it to another regular user - of course, easy way, > whole URL with session (_s=xxxx) - when another/regular user opens that > link -> whole "boss" session opens in regular user's browser, with all > "boss" permissions, UI state etc etc - very bad, is there any solution for > this? Rewrite every (!) URL with updateURL: is not solution :( > > If this is a concern, you can use a cookie for session tracking, but that > means you cannot have multiple Seaside sessions running in the same browser > at the same time. > > There are probably other ways, but I think the solution is not to rely on > a session key for authentication. > Hereâs a strategy: > Keep the Seaside session key in the url for session tracking but use an > authorization cookie for authorization. Put that cookie when the user logs > in and check its presence when requests come in for a session. > I think that using a filter for that is a good choice. > > Whenever another user copy/pastes the url, he cannot âhijackâ the session > because he lacks the correct authentication cookie. > > That's exactly what I did in my case. And the way to implement that was with a custom session tracker that dealt with the cookie plus a filter for the checking and kickout. I can share this if someone wants it (I think I already shared it before) > > 2) What is the actual way for "session expiration/login page"? There is > few tutorials and books on the inet - but info about session expiration is > obsolete :( Methods from tutorials not exists in Seaside 3.2.0. > > Some trick with WAApplication subclass is actual? > > Iâm not sure what the question is. Do you want to redirect users to a page > whenever the session is expired? > > cheers > Johan > -- Mariano http://marianopeck.wordpress.com

Sept. 21, 2016