Session tracking with URLs

[Yann Ramin <at...@atrustrivalie.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi, two questions:

1. I was thinking of doing session tracking first by cookies (I have a system 
which works well), but some people don't like cookies/don't support 
cookies/have broken cookies. I was thinking of running a mod_perl handler on 
the output which does a little regexp game of adding a session variable to 
the end of the URLs and forms. Has anyone done something like this? Is this a 
stupid idea?

2. How do I deal with browsers which do not return a referer header? Some 
parts of my web app depend heavily on it (goto page, page requires URL, sends 
to login page which captures referer of page where the user wants to go, logs 
in user, sends user back to the page seamlessly).

Thanks for your help

Yann

- -- 

- --------------------------------------------------------------------
Yann Ramin			atrus@atrustrivalie.org
Atrus Trivalie Productions	www.redshift.com/~yramin
AIM				oddatrus
Marina, CA			http://profiles.yahoo.com/theatrus

IRM Developer                   Network Toaster Developer
SNTS Developer                  KLevel Developer
Electronics Hobbyist		person who loves toys

When smashing monuments, save the pedstals -- they always come in handy.
                -- Stanislaw J. Lem, "Unkempt Thoughts"

"Outlook not so good." That magic 8-ball knows everything! I'll 
ask about Exchange Server next
- --------------------------------------------------------------------








-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD4DBQE6kx/Px6171htvP6YRAsikAJitY0asWUc5rVonHnKyb/j+DD1qAKCGdSli
dBxEuCkDtCthfUVr0CSRZg==
=1bU+
-----END PGP SIGNATURE-----

Re: Session tracking with URLs

[Bill Moseley <mo...@hank.org>]

At 05:54 PM 02/20/01 -0800, Yann Ramin wrote:
>1. I was thinking of doing session tracking first by cookies (I have a
system 
>which works well), but some people don't like cookies/don't support 
>cookies/have broken cookies. I was thinking of running a mod_perl handler on 
>the output which does a little regexp game of adding a session variable to 
>the end of the URLs and forms. Has anyone done something like this? Is
this a 
>stupid idea?

Placing sessions into the URL is described in the Eagle book.  And I use a
modified version of Apache::AuthCookie called Apache::AuthCookieURL that
does this -- it can be configured to just generate sessions.  Should be on
CPAN.

>2. How do I deal with browsers which do not return a referer header? Some 
>parts of my web app depend heavily on it (goto page, page requires URL,
sends 
>to login page which captures referer of page where the user wants to go,
logs 
>in user, sends user back to the page seamlessly).

It's probably best not to base your design on a browser feature that may or
may not work.  If you use sessions, then track referrers in the session
records.



Bill Moseley
mailto:moseley@hank.org