Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

session id cookie in gwt rpc

Assuming I'm rolling my own session code, what's the right way to generate a unique and secure session id cookie in java.

Should I not be rolling my own but using something that's already been standardized?

I'm using gwt and the google app-engine platform.

How do I make sessions persist across browser/server restarts?

like image 769
antony.trupe Avatar asked Sep 05 '09 00:09

antony.trupe


3 Answers

Using Servlet Sessions in GWT

In the remote service implementation class:

String jSessionId=this.getThreadLocalRequest().getSession().getId();

In the client code:

String jSessionId=Cookies.getCookie("JSESSIONID");

Enabling_Sessions

appengine-web.xml

<sessions-enabled>true</sessions-enabled>
like image 78
antony.trupe Avatar answered Oct 22 '22 09:10

antony.trupe


No, you shouldn't be rolling your own.

The session ID needs to be cryptographically random (not guessable from known sources). It's difficult to get this right yourself.

like image 29
Noon Silk Avatar answered Oct 22 '22 11:10

Noon Silk


Ideally you should be relying on the underlying framework's session management features. Servlets & JSPs, Struts and Spring have this support, which you should use.

In the extremely rare case that you are writing your own framework with no underlying session management features to rely on, you could start with the java.security.SecureRandom class to begin with. Of course, don't reinvent the wheel here, for broken session management is the same as broken authentication.

Update

Given that you are using Google App Engine, you should rely on the session management features provided by the engine. It seems that it is not switched on by default.

like image 26
Vineet Reynolds Avatar answered Oct 22 '22 11:10

Vineet Reynolds