Re: authentication with time out

From: Henrik Nordstrom <hno@dont-contact.us>
Date: Fri, 04 Feb 2000 23:45:49 +0100

Josh Kuperman wrote:
>
> Hmm.. indeed. I apologize for this post if there is a way to
> get more info from a redirection request than the requested URL.

Yes. A redirector is sent the following information:

* URL
* request method
* client IP
* user name from ident or proxy_auth

> Does it make sense for a redirector program to redirect to a cgi
> and have that cgi return the originally requested web page?

Does not sound like a good idea.

What I meant was to have the check for "time expired" in the redirector,
and redirect the user (by using a temporary browser redirect) the user
to a "time expired" page when required.

The authenticator verifies usernames+passwords as usual, and does not
care much about session time.

What you need to make this work is some kind of shared database amongst
all the redirectors where you can keep state information on your users.

A simple design of such a database which does not require shared memory
or other tricy buisiness is to use a plain text file database
a) When a new user session is detected by one of the redirectors, append
information about this session to the text table.
b) Have the redirectors reload this table into memory every 5 minutes or
so.
c) Have a cron entry which sorts the file, removes duplicates and prunes
old session, also run every 5 minutes or so.

/Henrik
Received on Sat Feb 05 2000 - 15:44:12 MST

This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 16:50:58 MST