W3C home > Mailing lists > Public > www-talk@w3.org > November to December 1995

Re: Statefulness (was ...URL...)

From: Pat La Claire <excalib!sparcy!pat@ucsd.edu>
Date: Fri, 1 Dec 95 08:30:22 PST
Message-Id: <9512011630.AA12066@sparcy.excalib>
To: Norderhaug.CHI@xerox.com, dnew@sgf.fv.com
Cc: www-talk@w3.org
> > Using the username/password as an identificator for a server-side session
> > state object.
> 
> Unfortunately, the server can't set that.  It would be nice if it could, 
> but you have to get the user to type it in, which can be annoying.
>  --Darren

we're required to have *some* form of access control to our httpd server.  we
require a username/password combination to "login" to our application.  once
login has been authorized, we generate a unique session key to identify this
user in the system until the user either logs out or timeouts.  the session
key is passed between the forms as a hidden field.  our cgi program embeds
the session key in the next form served.  this way we maintain whatever state
information that we need in our application (which is a server that the cgi
calls).  the application maintains a "user thread" that contains lots of stuff,
and is keyed off the session key.

this access control is by not means bullet proof, but all we need at this time.
Received on Friday, 1 December 1995 11:47:31 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Wednesday, 27 October 2010 18:14:18 GMT