cppcms-users

[Cppcms-users] Getting session cookie id upon session creation

[Geert V. de V. <gee...@ba...>]

Hi,

I want to put in my response to the creation of a new session after
login the session id. I'm unable to retrieve it when the session is just
created. The function get_session_cookie() returns an empty string. I
also tried calling the save() function of the session interface but this
doesn't seem to help.
Is it possible to retrieve the session cookie in another way?

Greetings,
Geert


DISCLAIMER:
Unless indicated otherwise, the information contained in this message is privileged and confidential, and is intended only for the use of the addressee(s) named above and others who have been specifically authorized to receive it. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this message and/or attachments is strictly prohibited. The company accepts no liability for any damage caused by any virus transmitted by this email. Furthermore, the company does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. If you have received this message in error, please contact the sender and delete the message. Thank you.

Re: [Cppcms-users] Getting session cookie id upon session creation

[Artyom <art...@ya...>]

> Is it possible to retrieve the session cookie  in another way?

At today's API it is possible to do this from client side only,
using JavaScript.  In order to be able to see response cookies
`cppcms::http::response` class should be extended to support it.
Quite trivial change.

Also you may create your own session backend, but this is BAD idea.

> I want to put in my response to the creation of a new session  after
> login the session id.

Why would you do such thing? This is quite bad idea as it has some
security issues as this data may leak somehow.

The best to keep it withing cookies.

Also please note, this is generally should not be session id

See <http://art-blog.no-ip.info/wikipp/en/page/cppcms_1x_config#session>

This maybe just encrypted or signed session data in cookie and not
some kind of id (depending on session backend you are using).

> The function get_session_cookie() returns an empty string.

You should not use this function as described in the manual
as it should be used only from implementations of session backend.

Note: get_session_cookie() gives incoming cookie data (i.e. request's cookie)
      and set_session_cookies() sets outgoing cookie data (i.e. response' 
cookie)
      and this cookie is set only after you save session.

So, simplest solution is to patch a little http::response for this
so it would support retrieving response cookies, not just setting them
(generally good thing to be in CppCMS's API), but I would 
suggest for you to rethink if you really need to have this cookie.

Artyom