1 / 19

Maintaining State

Maintaining State. MIS 324 Professor Sandvig. Maintaining State. Client-Server Model Tools: Cookies Session Security. Client-Server Model. Communication is intermittent Server needs to know “state” of each client Logged in UserID Items in cart Etc. Solution: cookies. Cookies.

kerrim
Download Presentation

Maintaining State

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Maintaining State MIS 324 Professor Sandvig

  2. Maintaining State • Client-Server Model • Tools: • Cookies • Session • Security

  3. Client-Server Model • Communication is intermittent • Server needs to know “state” of each client • Logged in • UserID • Items in cart • Etc. • Solution: cookies

  4. Cookies • Stored on user’s computer • Included with each request

  5. Cookies • Persist between sessions Source: https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies

  6. Cookies • Write: • Single value per cookie: • Response.Cookies[“Name”].Value = “Bart”; • Multiple values per cookie • Response.Cookies[“Name”][“First”] = “Bart”; • Response.Cookies[“Name”][“Last”] = “Simpson”; • Read • Request.Cookies[“Name”].Value; • Request.Cookies[“Name”][“First”].Value; • Where • Controller handles http requests • Is logical location for reading and writing cookies

  7. Cookies • Expiration: • Default: when browser is closed • Response.Cookies[“CookieName”].Expires = DateTime.Now.AddDays(180); • Delete Cookie: set expiration to past (-1)

  8. Cookies • Testing for cookie • Attempt to read a cookie that is not present:Error: Object reference not set to an instance of an object • Solution: If (Request.Cookies[“Name”] != null) { //safe to read cookie name = Request.Cookies[“Name”] .Value;}

  9. Cookies • Amazon.com

  10. Cookies • User can block • Chrome • Can’t do much…

  11. Cookies • Gmail

  12. Cookies • Benefits: • Persist between sessions • Keep track of usernames, last visit, etc. • Easy to use • Drawbacks: • Client can block • Not secure • Example: output (see handout for source)

  13. 2. Sessions • Data stored on server • Server create unique session ID for each user • Session data stored in server memory • Create: • Session[“LastName”] = “Simpson”; • Delete • Session.Abandon; – Deletes the session • Session.Remove[“LastName”]; – removes items

  14. Sessions • Uses cookie to pass SessionID with each request • User must have cookies enabled • Class example view with Chrome developer tools:

  15. Sessions • Expiration • Default: 20 minutes • Session.Timeout = 60; • Benefits • Secure • Client cannot view, edit, delete • Automatic timeout • Drawbacks • Do not persist • Require cookies • Use server resources

  16. Security • Session hijacking • Cookie Hijacking • Thief steals sessionID • Impersonates user • Session Hijacking

  17. Security • Solution • SSL • Browser IDs server • Encrypts all data

  18. Security • Require SSL for project - easy • Add to Global.asax • GlobalFilters.Filters.Add(new RequireHttpsAttribute()); • Not in MIS 324 • Too many issues with Visual Studio in labs

  19. Summary • Two options for maintaining state: • Cookies • Text stored by browser • Passed with each request • Persists between sessions • Sessions • Data stored in server memory • Secure • Auto timeout • Depends upon cookies for SessionID

More Related