The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
25 views

Create a browser cookie via executable on client machine

We have a web application that is accessed via kiosk workstations. We are looking for a way to track usage of each individual kiosk. Using the IP address was our first thought, but we quickly realized ...
1
vote
1answer
54 views

Should I use IP Address or Cookies for a simple rating plugin for my blog?

Basically, I have a blog where I want to add a rating system, which will allow users to rate each post on a scale from 1 to 5. I do not want the users to sign in, as that is too much hassle from my ...
-1
votes
1answer
67 views

Make browser allow secure cookie over http

Normally, browsers should not send cookies that have Secure option if connection is unsecured (i.e. http instead of https). Is there a configuration option or a plugin that would allow to change this ...
1
vote
1answer
149 views

Make PHP sessions truly last until the browser closes, and regenerating session on page requests

We have an issue where sessions are ending after a short time, 1440 seconds according to gc_maxlifetime settings which seems consistent with the issue. The PHPSESSID says it will expire when the ...
2
votes
1answer
99 views

Set authenticated users session cookie's to long term, but others to short term?

We want to extend the session duration for our users. I guess it doesn't matter for users who are not authenticated. We can create a PHPSESSID cookie for them and if it expires when they close their ...
2
votes
1answer
75 views

Is it acceptable for user agents to modify cookies other than by instruction from the server?

Using javascript or in a native iOS App it is possible to read and modify cookies. The server generally sets these, but if both the server and the client modifies the values then it becomes a global ...
1
vote
0answers
68 views

Alternatives to setting up an API system

I want to launch a service that could support integration by third-parties. Unfortunately it’s way out of hand to build an entire API by now. Here’s my question: Would there be any possible solution ...
1
vote
0answers
54 views

How to detect previous version cookies, and remove them?

We occasionally deploy our SSO system with some major changes. As much as we try to minimize it, on occasion we have require our users to delete all their "old" cookies. This is because their cookies ...
1
vote
1answer
97 views

Cross application cookie access

It was my understanding that cookies are transferred with each subsequent http request, yet if I log in to a web application that uses cookie authentication, say on my browser, other applications on ...
-1
votes
1answer
56 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
1
vote
2answers
358 views

Making a safe PHP login system [duplicate]

I am making a php website that requires user login. It has a remember me function. I would like to ask if the following approach is safe ? User logs in with correct username and pass (and remember ...
2
votes
2answers
990 views

Is setting “permanent” persistent login cookies a bad practice?

I realized that in Rails there is a built in permanent method for its persistent login cookies (aka. "remember me" cookies) method to give the client a cookie that expires in 20 years: cookies....
3
votes
4answers
996 views

Persistent RESTful state on client without cookies

I'm reading Roy Fielding's dissertation Architectural Styles and the Design of Network-based Software Architectures, which introduces the REST architectural style. Roy explains that cookies are a ...
3
votes
1answer
96 views

Is “friendly fire” session replay a valid concern?

I've been reading a lot about sessions and security, trying to learn as much as possible before writing too much code. I've read about limiting session replay by including a timestamp within the ...
21
votes
5answers
5k views

Why can't we use IP address instead of cookies in identifying the client in servlets?

I know we have some extra advantages in using the cookies over IP address, but my question is Why can't the container just remember the IP address of the client in identifying the client when he visit ...
0
votes
1answer
353 views

How to update last accessed with Forms Authentication cookie

I've got an MVC 4 site where I'm using Forms Authentication. I'm setting a cookie when a user logs in. The majority of my site does NOT require a user to be logged in though. What I'd like to do, ...
0
votes
0answers
47 views

Redirection methods for webpages

(This is question involving user experience, but I am primarily interested in the best practice technical solution to this common problem.) There are several places in my website where users are ...
0
votes
2answers
318 views

How can I handle Bots in a site that creates a database item every page

I have an eCommerce platform that creates a basket as soon as the user lands on the site if they don't already have one (from session or cookies). It then stores the basket information in session and ...
0
votes
1answer
316 views

Should I save a simple list cookie in Javascript or PHP?

I am currently making a simple list tool. You can click a checkbox to mark it as done and if you navigate away from the page/close the browser and reload, it will still be saved. So it's pretty much ...
0
votes
2answers
2k views

If we close browser window without getting logout, what will happen when we provide same URL in the browser?

A few days ago, I appeared in an interview in a software company for .net developer. There I was asked the following question: If we close browser window without getting logout, what will happen ...
3
votes
2answers
383 views

Is it correct to require end-users to clear their cookies?

Is it any indications of poor programming if the support staff for a given product requires you to clear the cookies in order to troubleshoot issues with their web-site? As a point of example, if you'...
1
vote
1answer
97 views

Is there a tool or process to help FOSS authors agree on a license? [closed]

The Evercookie project has several contributors and there is no explicit license for the code. There is currently discussion on the dev mailing list trying to figure out what the licensing options ...
4
votes
1answer
2k views

Controlling cookies with many tabs

I have a peculiar problem. My application has different levels of authentication. One specific level of user (super user) needs to be able to use the application as another user (subordinate user) ...
1
vote
3answers
3k views

Is path in Set-Cookie URL encoded?

I'm writing some code that sets cookies and I'm wondering about the exact semantics of the Set-Cookie header. Imagine the following HTTP header line: Set-Cookie: name=value; Path=/%20 For with path ...
-1
votes
2answers
299 views

should F12's request headers show session id as cookie?

I'm trying to educate myself on potential web attacks. I just found a site (which will rename anonymous) where it shows me what looks to be like the php session id inside the cookies section of the ...
3
votes
1answer
2k views

Understanding HTTP Cookies in Indy 10 for Delphi XE2

I have been working with Indy 10 HTTP Servers / Clients lately in Delphi XE2, and I need to make sure I'm understanding session management correctly. In the server, I have a "bucket" of sessions, ...
1
vote
2answers
113 views

Cookie Settings Storage Method

I've got an web app that needs to store some non-sensitive preferences for the user. Right now I'm storing their language preference and what mode they want a window opened in by default in two ...
8
votes
2answers
932 views

If I drop cookies with JavaScript will it still be compliant with the EU ICO Cookie Law?

The challenge proposed to me as to create a widget to apply in other sites that makes a website compliant with the cookie law[1]. Can I do this without changing server code? I mean, if there's code ...
4
votes
5answers
560 views

How to implement a no-login authentication system

I am looking to build a very loose authentication system that can track a user and link submitted data/comments to a specific user. The submissions are essentially anonymous, but a user may want to ...
10
votes
4answers
1k views

How will we be able to produce websites without using cookies with the new law? [duplicate]

Possible Duplicate: How do I comply with the EU Cookie Directive? Under this new EU law we are not allowed to use any cookies without asking first, I for one need to use a cookie to register ...
16
votes
3answers
1k views

How do I comply with the EU Cookie Directive?

On 26 May 2011, a new EU directive comes into force that users accessing websites should now be asked for permission to allow the website to store cookies containing information about them and their ...
12
votes
3answers
1k views

Why are requests for static content being sent to another site?

Whenever I login to stackoverflow or some sites I see lots of requests for sites like http://cdn.sstatic.net/. Why is this done rather than serving directly from the actual site? How does it help to ...