I have one web site that I maintain with a lot of different CF and flash
apps that all authenticate against a DB2 mainframe, and I'm using a CFC
to do it.. basically doing my own session management, storing a session
ID and userID in a local oracle database, and retrieving the user info
from the mainframe after authenticating them against the mainframe.
Plus, each time I authenticate the cookie, I make sure the username is
still valid in the mainframe..
When flash authenticates, I use _javascript_ to set the browser cookie, so
if you log into a flash app first, then you're logged in everywhere on
the site.. other flash apps, CF apps, etc..
We delete the sessions from the local oracle database every week just to
force people to log in at least once every week.
Because the entire site isn't running over SSL, the cookie is
transferred unsecurely sometimes, and a packet sniffer could read the
cookie, then that unscrupulous individual could set the cookie
themselves, and they'd be logged in as that person for the remainder of
the week.
I could probably get around this in a couple of ways... by forcing the
cookie to be passed securely as well (ie, running the entire web site
under SSL), or by storing the IP address associated with the session
cookie.. but that could cause problems with people coming in from places
like AOL, where each request they make may come through a different AOL
IP address because they send all their connections though some kind of
set of proxy servers... I'm not real sure about that one.
- Rick
[Todays Threads] [This Message] [Subscription] [Fast Unsubscribe] [User Settings] [Donations and Support]
