[英]Play framework how do sessions and cookies work?
How does play validate a cookie? 游戏如何验证cookie?
The cookie looks like this: cookie看起来像这样:
PLAY_SESSION=e6443c88da7xxxxxxxxxxxxxxxxxxxxxxxxxxxxx-userid%3A1 PLAY_SESSION = e6443c88da7xxxxxxxxxxxxxxxxxxxxxxxxxxxxx-的userid%3A1
// My logout code
def logout() = Action {
Ok("").withNewSession
}
From the documentation 从文档中
Discarding the whole session 丢弃整个会话
There is special operation that discards the whole session: 有特殊操作丢弃整个会话:
Ok("Bye").withNewSession
You didn't specify how do you authenticate users, so I just guess, that you;re using simple sample which is... simple. 您没有指定如何对用户进行身份验证,所以我只是猜测,您正在使用简单的简单示例。
It uses user's id to identify the user, and check if signed session cookie wasn't manipulated, therefore if you'll recreate the cookie with proper signature it will be valid still. 它使用用户的id来识别用户,并检查是否未操作已签名的会话cookie,因此如果您将使用适当的签名重新创建cookie,它仍然有效。
You should create some area for session's keys on the server side ie. 您应该在服务器端为会话密钥创建一些区域,即。 in DB or in memory cache (Which will be faster than DB).
在DB或内存缓存中(这将比DB快)。 Its key should be randomly generated (and preferebly quite long) for each successful login action, and should also contain data for identifying user, expiration date etc. Next you should put this random
sess_key
to the Play's session instead email address of logged user or id of his row in DB, and after logout and/or expiration date it should be removed. 对于每个成功的登录操作,其密钥应该是随机生成的(并且优选地相当长),并且还应该包含用于标识用户,到期日期等的数据。接下来,您应该将此随机
sess_key
放入Play的会话而不是已登录用户或id的电子邮件地址他在DB中的行,并且在注销和/或到期日期之后应该将其删除。 In such case even if you'll loose the cookie after logout it will be impossible to login properly with non-esixting sess_key
. 在这种情况下,即使您在注销后丢失cookie,也无法使用非esixting
sess_key
正确登录。
AFAIR standard memory cache will be purged at every restart of the application, to make sure that all sess_keys
from DB will be removed as well you can use Global object and truncate the table in onStart(...)
method. 每次重新启动应用程序时都会清除AFAIR标准内存缓存,以确保删除DB中的所有
sess_keys
,并且可以使用Global对象并在onStart(...)
方法中截断该表。
I found the answer reading the documentation more carefully and combining different parts. 我找到了更仔细阅读文档并结合不同部分的答案。
There is no technical timeout for the Session.
会话没有技术超时。 It expires when the user closes the web browser.
它在用户关闭Web浏览器时到期。 If you need a functional timeout for a specific application, just store a timestamp into the user Session and use it however your application needs (eg for a maximum session duration, maximum inactivity duration, etc.).
如果您需要特定应用程序的功能超时,只需将时间戳存储到用户会话中,然后根据您的应用程序需要使用它(例如,最长会话持续时间,最长不活动持续时间等)。
It's important to understand that Session and Flash data are not stored by the server but are added to each subsequent HTTP request, using the cookie mechanism.
重要的是要了解Session和Flash数据不是由服务器存储,而是使用cookie机制添加到每个后续HTTP请求中。 This means that the data size is very limited (up to 4 KB) and that you can only store string values.
这意味着数据大小非常有限(最多4 KB),并且您只能存储字符串值。
So that was what i feared that if the cookie get lost anyone can log in to the server for all future. 所以我担心如果cookie丢失,任何人都可以登录服务器以备将来使用。
What I have to do to secure this is to add a self-made timestamp authorization (save a timestamp in the cookie and validate sever side) 为确保这一点,我需要做的是添加一个自制的时间戳授权(在cookie中保存时间戳并验证服务器端)
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.