Cookieless sessions with ajax
I have developed a fairly "large application" with PHP and the kohana framework over the past 2 years with some success using the frame authentication mechanism. but during this time, and as the application has grown, many of the problems associated with persistence have arisen.
Main issues: sessions created with cookies:
- cannot be used to access a webservice (at least it really isn't nice to do).
- in many cases problematic with mobile access
- do not allow multiple concurrent applications in the same browser (can be allowed by hard trick, but still ..)
- requires a lot of config and mess to work 100% right, and no --browser issues (disabled cookies, old browser bugs and vulnerabilities, etc.).
many other session disadvantages pointed out in this old thread: http://lists.nyphp.org/pipermail/talk/2006-December/020358.html
After very much research and without any good library / on-hand solutions to meet my needs, I came up with a solution to most of these problems.
The solution I was thinking does not use cookies (for statefullness). instead mimicking it by passing the session token back and forth via ajax requests. For security reasons, the session token is regenerated on every request. In addition, the fingerprint (referrer, OS, clientVer) is saved on session creation and verified on every request.
At first glance, which should be no less secure than an equivalent implementation that depends on cookies, while at the same time simple, supported and removes all the flaws of cookies. But I'm really concerned that I often hear the rule "don't try to implement ad hoc security solutions."
I would greatly appreciate any serious feedback on this method and any alternatives.
-
any advice on how to save state on page refreshes without cookies would be great :) but this is a minor technical issue.
-
Sorry if I missed some similar posts .. There are billions of them about sessions.
Thanks a lot in advance (and for reading while here!).
a source to share
About saving the session token in refreshes / unintended back / next page -> great solution found: http://www.sitepoint.com/javascript-session-variable-library/ . It is cross browser and allows multiple concurrent logins (from different tabs / windows).
a source to share
I think this is the easiest way to use php session technology, but without cookies. You only need a few php functions to archive this result, but you have to send another var for each GET request.
session_start();
if(isset($_GET['SESSIONID']))
{
session_id($_GET['SESSIONID']);
}
echo "<script>var SESSIONID = '".session_id()."';/script>";
//session_id() autogenerates a new hash for every new session but you can you the algorithm that you prefer.
Ok, now in every JS script you have a session id, so you only need to add it to the url.
a source to share