Difference between revisions for Users / Eo Ny
|
← Previous edit
|
Next edit →
|
| Merge of Version1 & Version2 | |
|---|---|
| 1 | == Session Management Technical Documentation == |
| 2 | {{toc numerate=1}} |
| 3 | |
| 4 | === Overview === |
| 5 | |
| 6 | The ##Session## class is an abstract session management system for WackoWiki that extends ##ArrayObject## to provide secure, configurable session handling. It implements sophisticated security features including session ID regeneration, anti-replay protection, nonce verification, and user agent/IP validation. |
| … | … |
| 1807 | |
| 1808 | ---- |
| 1809 | |
| 1810 | ===TODO Items (From Code Comments)=== |
| 1811 | The following improvements are planned: |
| 1812 | 1. **Do not store session ID in filename or DB index - store hash instead** |
| 1813 | |
| 1814 | |
| 1815 | 2. **Log of IP changes and other possible security alerts** |
| 1816 | |
| 1817 | |
| 1818 | 3. **Allocate internal unique session which lives through lifetime of uber-session** |
| 1819 | |
| 1820 | |
| 1821 | 4. **Do not delete old sessions, but use them as hijack pointers** |
| 1822 | |
| 1823 | |
| 1824 | |
| 1825 | 5. **All SIDs used later than ~5secs of regenerations is hijacks** |
| 1826 | |
| 1827 | |
| 1828 | |
| 1829 | |
| 1830 | ---- |
| 1831 | |
| … | … |
| 1852 | |
| 1853 | ---- |
| 1854 | |
| 1855 | === |
| 1856 | - **Current**: Abstract session class with security features |
| 1857 | - **Planned**: Implementation of TODO items above |
| 1858 | |
| 1859 | ---- |
| 1860 | |
| 1861 | |