Sharing Seaside URLs between users (security) + what is actual way for session expiration page
Hello, two questions about Seaside sessions: 1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :( 2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. Some trick with WAApplication subclass is actual? Thanks very much! pf
1) If you share the url with the _s parameter, then you can continue that session in other browser/machine. This is so because by the default the application uses WAQueryFieldHandlerTrackingStrategy as the #trackingStrategy config. But you can override it and use any of the WAHandlerTrackingStrategy concrete subclasses, to make it cookie based or IP based. 2) There is no special trick regarding the session, but it is true there is no default "authentication/login" component ready to be used. All sessions have an instance of WASession, preferably one subclass of your own, which you must "login" or "logout" based on your own criteria. You can modify the expiration time as well as completely remove it explicitly by sending #unregister to the session object, usually as part of a "logout" or "signout" method of your own. I hope this helps. Regards, Esteban A. Maringolo 2016-09-21 7:31 GMT-03:00 Petr Fischer <petr.fischer@me.com>:
Hello, two questions about Seaside sessions:
1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :(
2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. Some trick with WAApplication subclass is actual?
Thanks very much! pf
On Wed, Sep 21, 2016 at 7:31 AM, Petr Fischer <petr.fischer@me.com> wrote:
Hello, two questions about Seaside sessions:
1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :(
Probably it's not what you need, but in my case I wanted to forbid (show an error) what you call "URL sharing" because of security issues. Anyway, if you want this, let me know and I show you how I did it.
2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. Some trick with WAApplication subclass is actual?
Thanks very much! pf
-- Mariano http://marianopeck.wordpress.com
Hello, two questions about Seaside sessions:
1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :(
Probably it's not what you need, but in my case I wanted to forbid (show an error) what you call "URL sharing" because of security issues. Anyway, if you want this, let me know and I show you how I did it.
Yes this is also possible, but instructing users that do not share their URLs is insufficient (they will do it!). How is possible to "forbid" URL copy/pasting from one browser to another? With session + auth cookie tracking strategy (already suggested in this thread)?
2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. Some trick with WAApplication subclass is actual?
Thanks very much! pf
-- Mariano http://marianopeck.wordpress.com
On 21 Sep 2016, at 12:31, Petr Fischer <petr.fischer@me.com> wrote:
Hello, two questions about Seaside sessions:
1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :(
If this is a concern, you can use a cookie for session tracking, but that means you cannot have multiple Seaside sessions running in the same browser at the same time. There are probably other ways, but I think the solution is not to rely on a session key for authentication. Hereâs a strategy: Keep the Seaside session key in the url for session tracking but use an authorization cookie for authorization. Put that cookie when the user logs in and check its presence when requests come in for a session. I think that using a filter for that is a good choice. Whenever another user copy/pastes the url, he cannot âhijackâ the session because he lacks the correct authentication cookie.
2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. Some trick with WAApplication subclass is actual?
Iâm not sure what the question is. Do you want to redirect users to a page whenever the session is expired? cheers Johan
On Wed, Sep 21, 2016 at 11:50 AM, Johan Brichau <johan@inceptive.be> wrote:
On 21 Sep 2016, at 12:31, Petr Fischer <petr.fischer@me.com> wrote:
Hello, two questions about Seaside sessions:
1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :(
If this is a concern, you can use a cookie for session tracking, but that means you cannot have multiple Seaside sessions running in the same browser at the same time.
There are probably other ways, but I think the solution is not to rely on a session key for authentication. Hereâs a strategy: Keep the Seaside session key in the url for session tracking but use an authorization cookie for authorization. Put that cookie when the user logs in and check its presence when requests come in for a session. I think that using a filter for that is a good choice.
Whenever another user copy/pastes the url, he cannot âhijackâ the session because he lacks the correct authentication cookie.
That's exactly what I did in my case. And the way to implement that was with a custom session tracker that dealt with the cookie plus a filter for the checking and kickout. I can share this if someone wants it (I think I already shared it before)
2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. Some trick with WAApplication subclass is actual?
Iâm not sure what the question is. Do you want to redirect users to a page whenever the session is expired?
cheers Johan
-- Mariano http://marianopeck.wordpress.com
Mariano, this would be a perfect article for your blog (hint, hint) and I'd be one of the first and excited readers. I must admit I sometimes am frightened by all the filters and whatnot that I could be using for certain tasks. I always feel like I miss half of what the power of Seaside is because there is no documentation or tutorias on all that stuff (or are there????) So it would be great if you could not only share your code but also explain it a little bit, for dummies like me... Joachim
Mariano,
this would be a perfect article for your blog (hint, hint) and I'd be one of the first and excited readers. I must admit I sometimes am frightened by all the filters and whatnot that I could be using for certain tasks. I always feel like I miss half of what the power of Seaside is because there is no documentation or tutorias on all that stuff (or are there????)
Exactly! There is some documentiation on the net, but documentation is often obsolete - even official documentation (book.seaside.st for example). Blog post is nice and welcome, but blogs and blog systems die sometimes and then what? Also there is some article/blog post for very old Seaside, another article for pre-actual Seaside and no article for actual Seaside... Central point (under pharo.org) for all the valid actual knowledge resources is necessary (IMHO).
So it would be great if you could not only share your code but also explain it a little bit, for dummies like me...
Joachim
Hello, two questions about Seaside sessions:
1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :(
If this is a concern, you can use a cookie for session tracking, but that means you cannot have multiple Seaside sessions running in the same browser at the same time.
There are probably other ways, but I think the solution is not to rely on a session key for authentication. Hereâs a strategy: Keep the Seaside session key in the url for session tracking but use an authorization cookie for authorization. Put that cookie when the user logs in and check its presence when requests come in for a session. I think that using a filter for that is a good choice.
Whenever another user copy/pastes the url, he cannot âhijackâ the session because he lacks the correct authentication cookie.
That's exactly what I did in my case. And the way to implement that was with a custom session tracker that dealt with the cookie plus a filter for the checking and kickout.
I can share this if someone wants it (I think I already shared it before)
Other beginners with Pharo/Seaside might appreciate if it was standard part of Seaside. In standard Seaside package, there is for example class WAIPSessionTrackingStrategy, it's nice as example, but unusable in real world. Your session tracking strategy is definitely more useful - can you share? Can you share with Seaside developers? :)
2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. Some trick with WAApplication subclass is actual?
Iâm not sure what the question is. Do you want to redirect users to a page whenever the session is expired?
cheers Johan
-- Mariano http://marianopeck.wordpress.com
Mariano It would be cool. Why don't you paste it on your blog? I hope to get back to the seaside book one of these days and I would like to add such tips and tricks Stef Le 21/9/16 à 18:00, Mariano Martinez Peck a écrit :
On Wed, Sep 21, 2016 at 11:50 AM, Johan Brichau <johan@inceptive.be <mailto:johan@inceptive.be>> wrote:
> On 21 Sep 2016, at 12:31, Petr Fischer <petr.fischer@me.com <mailto:petr.fischer@me.com>> wrote: > > Hello, two questions about Seaside sessions: > > 1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :(
If this is a concern, you can use a cookie for session tracking, but that means you cannot have multiple Seaside sessions running in the same browser at the same time.
There are probably other ways, but I think the solution is not to rely on a session key for authentication. Hereâs a strategy: Keep the Seaside session key in the url for session tracking but use an authorization cookie for authorization. Put that cookie when the user logs in and check its presence when requests come in for a session. I think that using a filter for that is a good choice.
Whenever another user copy/pastes the url, he cannot âhijackâ the session because he lacks the correct authentication cookie.
That's exactly what I did in my case. And the way to implement that was with a custom session tracker that dealt with the cookie plus a filter for the checking and kickout.
I can share this if someone wants it (I think I already shared it before)
> 2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. > Some trick with WAApplication subclass is actual?
Iâm not sure what the question is. Do you want to redirect users to a page whenever the session is expired?
cheers Johan
-- Mariano http://marianopeck.wordpress.com
OK, "TooMuchPressureExpcetion signal". I will do it. There is another open-source-task related to OSSubprocess that I must address first. Then will come to this one. Probably I can also put the code in github. Will let you know when ready. Cheers, On Thu, Sep 22, 2016 at 2:53 PM, stepharo <stepharo@free.fr> wrote:
Mariano
It would be cool.
Why don't you paste it on your blog?
I hope to get back to the seaside book one of these days and I would like to add such tips and tricks
Stef
Le 21/9/16 à 18:00, Mariano Martinez Peck a écrit :
On Wed, Sep 21, 2016 at 11:50 AM, Johan Brichau <johan@inceptive.be> wrote:
On 21 Sep 2016, at 12:31, Petr Fischer <petr.fischer@me.com> wrote:
Hello, two questions about Seaside sessions:
1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :(
If this is a concern, you can use a cookie for session tracking, but that means you cannot have multiple Seaside sessions running in the same browser at the same time.
There are probably other ways, but I think the solution is not to rely on a session key for authentication. Hereâs a strategy: Keep the Seaside session key in the url for session tracking but use an authorization cookie for authorization. Put that cookie when the user logs in and check its presence when requests come in for a session. I think that using a filter for that is a good choice.
Whenever another user copy/pastes the url, he cannot âhijackâ the session because he lacks the correct authentication cookie.
That's exactly what I did in my case. And the way to implement that was with a custom session tracker that dealt with the cookie plus a filter for the checking and kickout.
I can share this if someone wants it (I think I already shared it before)
2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. Some trick with WAApplication subclass is actual?
Iâm not sure what the question is. Do you want to redirect users to a page whenever the session is expired?
cheers Johan
-- Mariano http://marianopeck.wordpress.com
-- Mariano http://marianopeck.wordpress.com
Hello, two questions about Seaside sessions:
1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :(
If this is a concern, you can use a cookie for session tracking, but that means you cannot have multiple Seaside sessions running in the same browser at the same time.
There are probably other ways, but I think the solution is not to rely on a session key for authentication. Hereâs a strategy: Keep the Seaside session key in the url for session tracking but use an authorization cookie for authorization. Put that cookie when the user logs in and check its presence when requests come in for a session. I think that using a filter for that is a good choice.
Whenever another user copy/pastes the url, he cannot âhijackâ the session because he lacks the correct authentication cookie.
This sounds reasonable. Thanks.
2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. Some trick with WAApplication subclass is actual?
Iâm not sure what the question is. Do you want to redirect users to a page whenever the session is expired?
Yes, just ordinary redirect to login page, with proper expiration notice (when session is expired). Another question is, how to handle session expiration inside AJAX call (also with proper redirect to login page with expiration notice) - this is harder - there is some solutions, like "ping" from web browser to Seaside server, so the session never expires, but this is in conflict with my/common needs (I want session timeout with auto logouts).
cheers Johan
participants (6)
-
Esteban A. Maringolo -
Johan Brichau -
jtuchel＠objektfabrik.de -
Mariano Martinez Peck -
Petr Fischer -
stepharo