I want cookies which is set from test.domain.com to be set for .domain.com so that that it can still be used from anothertest.domain.com. Basically cookies should be shared between subdomains.
I called backend deployed at test.domain.com and set cookies with OK response as follows:
Ok("some response").withCookies(Cookie("id", id), Cookie("token", token))
And in application.conf I have set the session domain to ".domain.com"-
session {
\#Sets the cookie to be sent only over HTTPS.
\#secure = true
\#Sets the cookie to be accessed only by the server.
\#httpOnly = true
\#Sets the max-age field of the cookie to 5 minutes.
\#NOTE: this only sets when the browser will discard the cookie. Play will consider any
\#cookie value with a valid signature to be a valid session forever. To implement a server side session timeout,
\#you need to put a timestamp in the session and check it at regular intervals to possibly expire it.
\#maxAge = 300
\#Sets the domain on the session cookie.
domain = ".domain.com"
}
However, the cookie is being set for test.domain.com rather than .domain.com.
I want to use this cookie with anothertest.domain.com .
Can you please help me with this.
You don't have to change the configuration, you can add all attributes of a cookie when creating it.
Cookie("bla", bla).withDomain(xxx)
// Or
Cookie("bla", bla, domain = XXX)
(Not sure of exact name, I don't have documentation with me right now)
Related
I have a problem where my idsrv cookie never seems to have a physical expiry time. So users on shared computers are logging in as each other because nobody appears to close their browser to kill this cookie.
Can someone please shed some light on what I should be doing?
You need to use persistent cookies to set the expiration, this will persist the cookie over browser sessions but also allow you to set the expiry. You don't mention which version of ASP.NET you're using but here's an example using aspnet core (the third parameter here must be true to persist the cookie):
var result =
await _signInManager.PasswordSignInAsync(model.Email, model.Password, true, true);
There are other ways to sign in but one way or another you'll have an overload that will allow you to set the persistent flag.
Then elsewhere you need to set the expiry when setting up cookie options you can specify the expiry time, e.g. if using Asp.Net Identity:
services.AddIdentity<ApplicationUser, IdentityRole>(
o => o.Cookies.ApplicationCookie.ExpireTimeSpan = TimeSpan.FromMinutes(30));
(Bear in mind that if you are on core and you upgrade to or use v2.0 you'll need to use services.ConfigureApplicationCookie instead, see here).
Of course this might not eliminate your users swapping machines within the expiration period but you can make the expiry small. What you can also do is use the SlidingExpiration flag alongside the expiry:
The SlidingExpiration is set to true to instruct the middleware to re-issue a new cookie with a new expiration time any time it processes a request which is more than halfway through the expiration window.
Meaning you can decrease the expiration time and so long as the user is still active they'll get new cookies. So the above code could be adjusted to:
services.AddIdentity<ApplicationUser, IdentityRole>(o =>
{
o.Cookies.ApplicationCookie.ExpireTimeSpan = TimeSpan.FromMinutes(10);
o.Cookies.ApplicationCookie.SlidingExpiration = true;
});
Hope someone can help me explain some of my questions in order:
1. When i set application/config/config.php:
Determines whether the XSS filter is always active when GET, POST or
COOKIE data is encountered.
$config['global_xss_filtering'] = TRUE;
So if I set the default value is FALSE. What benefits will I get? For example, the performance or processing speed of the server?
2. Session
function save(){
$data = $this->input->post('number',TRUE);
$this->session->set_userdata('TEST',$data);
}
//Suppose Client request GET to action
function insert(){
$num = $this->session->userdata('TEST');
//Do I need to filter data in session?
$num_clean = $this->security->xss_clean($num );
$this->model->run_insert($num_clean);
}
I do not trust the user. And I still do not understand much about: session activity
The server just sends the ID Session to the client. Does the server send the data, which I set up to the session, to the client?
Best way xss_clean for session Which i am using is: Filter the client data by xss_clean input class. Is that enough? And need to re-filter session again?
Hope someone helped me because I just using only Codeigniter's XSS filter. Thanks
part 1:
From CodeIgniter User Guide Version 2.2.6
XSS Filtering
CodeIgniter comes with a Cross Site Scripting Hack prevention filter which can either run automatically to filter all POST and COOKIE data that is encountered, or you can run it on a per item basis. By default it does not run globally since it requires a bit of processing overhead, and since you may not need it in all cases.
It's not something that should be used for general runtime processing since it requires a fair amount of processing overhead.
So answerto your 1st part of question : yes ,
setting $config['global_xss_filtering'] = false; has performance benefits. also in codeigniter 3 its This feature is DEPRECATED. So i prefer to set it false.
part 2 :
Session is different from cookie
Unlike a cookie, the information is not stored on the users computer. So when you store a session ,its safe to trust the session data.
session data are stored in server. Most sessions set a user-key on the user's computer that looks something like this: 765487cf34ert8dede5a562e4f3a7e12. Then, when a session is opened on another page, it scans the computer for a user-key. If there is a match, it accesses that session, if not, it starts a new session.
here is a simple guide to session to read https://www.w3schools.com/php/php_sessions.asp
deftailed one : http://php.net/manual/en/intro.session.php
in short $num_clean = $this->security->xss_clean($num ); this is unnecessary.
I just found out that there is an existing default cookie name in Cookie before i actually adds my cookie name into it. That default cookie is JSESSIONID.
Collection<String> cookies = Cookies.getCookieNames();
for (String cookie : cookies) {
String cookieValue = Cookies.getCookie(cookie);
String[] itemMeaningIDcompanyMeaningID=cookie.split("_");
}
If i live the default cookie there, then i have a problem cos I need to convert cookie name into array so i may split the default cookie & that could cause runtime error.
i suspect that the default cookie is used for something else in GWT, so if i remove it then the system may not run properly.
So my question is, should i remove that default cookie or i just leave it there?
JSESSIONID is a cookie generated by the servlet container (like Tomcat or Jetty) and used for session management. You should leave it there unless you don't use sessions and don't plan to use them ever (which is rarely the case for any non trivial webapp).
How do i set a cookie in mojolicious response and later read it from the request. I tried different ways but none of them set cookie on the response object.
tried these ways
$self->res->cookies({name => 'foo', value => 'bar'});
$self->res->headers->set_cookie('foo=bar');
$self->res->headers->cookie('foo=bar');
plz, help!!
thanks.
You can use the shortcut methods directly from the controller:
# Set
$self->cookie(foo => 'bar');
# Get
$self->cookie('foo');
http://mojolicio.us/perldoc/Mojolicious/Controller#cookie
However, if your intent is simply to store a value and retrieve it on subsequent requests, there's no need to set cookies directly. Mojolicious sessions use signed cookies by default, will handle the complexities of the cookies, and will verify that the values have not been changed by the client.
# Set
$self->session(foo => 'bar');
# Get
$self->session('foo');
http://mojolicio.us/perldoc/Mojolicious/Controller#session
If sessions are the best solution for you, make sure you set your app secret. Also, check out:
http://mojocasts.com/e4#Session
I have a cookie save a token when a user logs into www.example.com and then it redirects them to example.com/desktop or example.com/mobile depending on what device they're using. When they log out of the desktop app I replace the cookie with null and then call remove cookie in GWT and redirect them to www.example.com, but the cookie still exists. Am I doing something wrong here? I haven't worked with cookies much before so I'm a bit new to this.
Because the cookie was set at another path, you have to use Cookies.removeCookie("cookieName", "/") (/ being the path used in your example) and not Cookies.removeCookie("cookieName").
This is because without a specified path, the path defaults to the one of the current page (see document.cookie).
So, you're trying to remove the cookie at path=/desktop, whereas it's actually at path=/, so the removal fails.
Remember that you could have two cookies with the same name but different paths; so you could have a cookieName at path=/ and a _cookieName at path=/desktop. Removing the cookie at path=/ won't remove the one at path=/desktop, and conversely, removing the one at path=/desktop won't remove the one at path=/.
As a side note: when accessing /desktop, the browser would send both cookies, which could have different values.
In brief, because you set your cookie at /, remember to always pass / as the path, everywhere, or you could create a new cookie rather than modifying the existing one, or fail to remove it (which you're experiencing right now).
See also Cookies.removeCookie(String,String)
In case you also need a non-default domain use
public static native void removeCookie(String name, String path, String domain) /*-{
$doc.cookie = name + "=" + ((path) ? ";path=" + path : "")
+ ((domain) ? ";domain=" + domain : "")
+ ";expires=Thu, 01 Jan 1970 00:00:01 GMT";
}-*/;