Re: [Cppcms-users] SSE keep-alive
Brought to you by:
artyom-beilis
Menu
▾
▴
Re: [Cppcms-users] SSE keep-alive
|
From: Christian G. <chr...@gm...> - 2013-04-03 08:04:43
|
2013/4/3 Artyom Beilis <art...@ya...>:
> ----- Original Message -----
>
>> 2013/4/2 Artyom Beilis <art...@ya...>:
>>> Small notes:
>>>
>>> 1. Session is saved when the output stream is accessed first time, as you
>>> need to provide set session cookies.
>>>
>>> Remember the session data may be stored entirely on the client
>>> side in signed cookies.
>>>
>>
>> "session" : {
>> "expire" : "renew",
>> "timeout" : 15,
>> "location" : "server",
>> "gc" : 10,
>> "server": {
>> "storage":"memory"
>> }
>> },
>>
>> The session data itself is store on the server side - or?
>>
>>> Saving session after output was provided is similar to an attempt
>>> to set a cookie **after** HTTP headers were sent.
>>>
>>
>> Okay
>>
>
>>> 2. Calling changing session values and calling save after the output
>>> was generated has undefined behavior.
>>>
>>
>> I am not changing any value stored in the session. I only want to renew
>> the session. For me it is a problem when the cppcms session gets deleted
>> if a script runs e.g. 15 minutes. On the client side there is only one open
>> SSE stream.
>
>
> Why wouldn't you increase the timeout on session such that it would not expire so quickly?
> In general session is something long running - months, days, sometime hours for more sensitive
> applications and tens of minutes for very sensitive applications like banking web sites.
>
There is a requirement that the user get logged out after 10 minutes
of inactivity as the application
is sensitive.
> The primary role of session is to carry user identification and other various user
> specific properties.
>
>>
>
>>> So your code is incorrect.
>>>
>>> I think you mix up two different things: HTTP Stream session - the
>>> state where the connection is open and you push the data to the stream
>>> (it is represented by cppcms::http::context and actual open TCP/IP socket)
>>> and the CppCMS/Web session the information shared **accorss** different
>>> connections - that is based cookies - the state for stateless HTTP.
>>>
>>
>> As far as I can tell from studying the source code a cppcms::http::context gets
>> created if the client does a get/post.
>> This context has access to the request(), the response() and the assigned cppcms
>> session().
>>
>> In my case the life-time strategy is set to "renew". This means the
>> client needs to
>> do a get/post to create a cppcms::http::context as this action will
>> trigger the "renew"
>> logic - or?
>>
>> Is there a way to do the "renew" of the cppcms::session from the
>> server side?
>> Again from reading the code the cppcms::sessions::session_storage class
>> provides methods to load and save session data. The garbage logic is inside
>> such a inherited class.
>
> No, if there is no request the session would get expired, regardless garbage
> collection.
>
That is not correct... if I am using my
session_interface::renew_session() method it
will trigger a call to
void session_storage::save(std::string const &key,time_t
to,std::string const &value)
which saves the session with a updated time_t to value. As a result of
this I am able
to renew a cppcms::session for hours - did run a test over the night.
So I think this works for server side stored sessions.
The only problem I see is that the cookie 'cppcms_session' - in my
case - expires as defined.
So I can not renew it on the browser side. That would mean that the
script runs nicely but if
any get/post gets triggered the cookie is not valid any more and the
user is not logged in.
>
> GC is needed to collect expired sessions but the session expiration does not
> depend on GC, it is session specific property.
>
It is yes... but if i call load() and save() the session expiration
gets updated.
>
>>
>> If the session data is stored on the server side and the cookie in the
>> browser only stores
>> the session key it should be possible to renew a cppcms::session.
>> And this is what I doing in this code snippet.
>>
>> void session_interface::renew_session()
>> {
>> loaded_ = 0;
>> saved_ = 0;
>>
>> load();
>> save();
>> }
>>
>> If there is no way to "renew" the cppcms::session on the server side,
>> I need to
>> add some js code to the client side doing silly gets to trigger the
>> "renew" of
>> the cppcms::session.
>>
>
> I understand what you say but this is not something that is supported.
>
> You may open a feature request to provide an access to server side
> session storage from an API that is not connected to a specific
> cppcms::http::context and renew session.
>
>
> What you can actually do is to implement an alternative server side storage:
>
> http://cppcms.com/cppcms_ref/1.0.2/classcppcms_1_1sessions_1_1session__storage.html
>
I am using my own session_storage as every session gets a own 'tmp'
folder to upload and
download data. This is also I need to 'renew' the session as a script
works on data stored in
such a 'tmp' folder. It would be bad to delete files inside the 'tmp'
folder if a script runs.
>
> That would allow you to handle the timeout in different way and probably update
> the session from your application directly.
>
> But this is a hack.
>
I am not interested in hacks which can not find its way back into the
upstream project like cppcms.
So the best would be to write some JS to handle my problem. Should not
be too hard to do
a 'keep_alive' get via ajax.
Thanks a lot for your time.
greets
--
Christian Gmeiner, MSc
--
Christian Gmeiner, MSc
2013/4/3 Artyom Beilis <art...@ya...>:
> ----- Original Message -----
>
>> 2013/4/2 Artyom Beilis <art...@ya...>:
>>> Small notes:
>>>
>>> 1. Session is saved when the output stream is accessed first time, as you
>>> need to provide set session cookies.
>>>
>>> Remember the session data may be stored entirely on the client
>>> side in signed cookies.
>>>
>>
>> "session" : {
>> "expire" : "renew",
>> "timeout" : 15,
>> "location" : "server",
>> "gc" : 10,
>> "server": {
>> "storage":"memory"
>> }
>> },
>>
>> The session data itself is store on the server side - or?
>>
>>> Saving session after output was provided is similar to an attempt
>>> to set a cookie **after** HTTP headers were sent.
>>>
>>
>> Okay
>>
>
>>> 2. Calling changing session values and calling save after the output
>>> was generated has undefined behavior.
>>>
>>
>> I am not changing any value stored in the session. I only want to renew
>> the session. For me it is a problem when the cppcms session gets deleted
>> if a script runs e.g. 15 minutes. On the client side there is only one open
>> SSE stream.
>
>
> Why wouldn't you increase the timeout on session such that it would not expire so quickly?
> In general session is something long running - months, days, sometime hours for more sensitive
> applications and tens of minutes for very sensitive applications like banking web sites.
>
> The primary role of session is to carry user identification and other various user
> specific properties.
>
>>
>
>>> So your code is incorrect.
>>>
>>> I think you mix up two different things: HTTP Stream session - the
>>> state where the connection is open and you push the data to the stream
>>> (it is represented by cppcms::http::context and actual open TCP/IP socket)
>>> and the CppCMS/Web session the information shared **accorss** different
>>> connections - that is based cookies - the state for stateless HTTP.
>>>
>>
>> As far as I can tell from studying the source code a cppcms::http::context gets
>> created if the client does a get/post.
>> This context has access to the request(), the response() and the assigned cppcms
>> session().
>>
>> In my case the life-time strategy is set to "renew". This means the
>> client needs to
>> do a get/post to create a cppcms::http::context as this action will
>> trigger the "renew"
>> logic - or?
>>
>> Is there a way to do the "renew" of the cppcms::session from the
>> server side?
>> Again from reading the code the cppcms::sessions::session_storage class
>> provides methods to load and save session data. The garbage logic is inside
>> such a inherited class.
>
> No, if there is no request the session would get expired, regardless garbage
> collection.
>
> GC is needed to collect expired sessions but the session expiration does not
> depend on GC, it is session specific property.
>
>
>>
>> If the session data is stored on the server side and the cookie in the
>> browser only stores
>> the session key it should be possible to renew a cppcms::session.
>> And this is what I doing in this code snippet.
>>
>> void session_interface::renew_session()
>> {
>> loaded_ = 0;
>> saved_ = 0;
>>
>> load();
>> save();
>> }
>>
>> If there is no way to "renew" the cppcms::session on the server side,
>> I need to
>> add some js code to the client side doing silly gets to trigger the
>> "renew" of
>> the cppcms::session.
>>
>
> I understand what you say but this is not something that is supported.
>
> You may open a feature request to provide an access to server side
> session storage from an API that is not connected to a specific
> cppcms::http::context and renew session.
>
>
> What you can actually do is to implement an alternative server side storage:
>
> http://cppcms.com/cppcms_ref/1.0.2/classcppcms_1_1sessions_1_1session__storage.html
>
>
> That would allow you to handle the timeout in different way and probably update
> the session from your application directly.
>
> But this is a hack.
>
>
>> thanks
>> --
>> Christian Gmeiner, MSc
>>
>
>
> Artyom Beilis
> --------------
> CppCMS - C++ Web Framework: http://cppcms.com/
> CppDB - C++ SQL Connectivity: http://cppcms.com/sql/cppdb/
>
> ------------------------------------------------------------------------------
> Minimize network downtime and maximize team effectiveness.
> Reduce network management and security costs.Learn how to hire
> the most talented Cisco Certified professionals. Visit the
> Employer Resources Portal
> http://www.cisco.com/web/learning/employer_resources/index.html
> _______________________________________________
> Cppcms-users mailing list
> Cpp...@li...
> https://lists.sourceforge.net/lists/listinfo/cppcms-users
|
