Session lifetime - Maximum?

[CALocklin]

Is there a maximum allowable session lifetime that the WAS can accept?

Also, does anyone know of any reasons not to make the session lifetime, for example, 12 hours?

A related question: Is there a way to kill a session or would "logging out" be just a matter of blanking out any session variables? (I know it doesn't log out when the browser is closed. I'm wondering about forcing a logout if the user presses a logout button.)

[Lenny Forziati]

Is there a maximum allowable session lifetime that the WAS can accept?

Also, does anyone know of any reasons not to make the session lifetime, for example, 12 hours?

Sessions consume memory. How much they consume depends on how you are using them and what you are storing as session variables. If you have an app with many users and the session lifetime is long, your server will use more memory than if the session lifetime is short.

I'd be curious to know what you are storing in the session that you would like to have available for so long. There are other techniques to maintaining much of the stuff that is typically stored in a session that often result in a much better user experience. An example would be the common "remember me" functionality that many sites use.

A related question: Is there a way to kill a session or would "logging out" be just a matter of blanking out any session variables? (I know it doesn't log out when the browser is closed. I'm wondering about forcing a logout if the user presses a logout button.)

session.reset() will delete everything you've stored in the session. It does not delete the session itself however, there is no way to do that.

[CALocklin]

Thanks Lenny. It was mostly a generic question resulting from a customer request to extend the current session time. But, as I think you know, I always like to understand the whys and the pros & cons of what I'm doing.

I was also thinking of other possible ways to store the needed info (cookies?) but hadn't put a lot of thought into it yet. The only things I would really need to store are a filter string so they could start over from their last filter definition and, maybe, their login ID.

I was reading up on cookies and, although I haven't used them before, that seems like the way to do it. (From the Help files: "A cookie's value is available directly as a variable in your page." - seems almost too easy.) Is there another way (or ways) that I should also consider?

Thinking about using cookies for variables, would that be another way to "hide" the variable string from the user? (For example, a "get" method will allow the user to see all variables in the url string while a "post" hides them. It seems like using a cookie would also hide the data from the user.)

[CALocklin]

Hmmm, as I think about it cookies may not work. They plan to make this application available from some libraries and the library computers may be set to not accept cookies.

[Lenny Forziati]

Hmmm, as I think about it cookies may not work. They plan to make this application available from some libraries and the library computers may be set to not accept cookies.

Cookies would be the typical approach, though you could also append a unique ID to every URL. If you turn off cookies in your browser and visit your Web App Server, you'll see that the server does exactly this to maintain the session state.

However, never trust a cookie for anything related to security. While the cookie value is not visible in the URL as you mentioned, it is available to the user as a text file on their hard drive. So if you created a cookie such as logged_in_user and trusted its value for restricting access to your site, I could login as "Lenny", then change my cookie to store "admin" and potentially do whatever I'd like with your site.

Instead, it is better to store a single cookie on the browser that has some unique, but meaningless, value to identify the specific visitor. You can then use a table on the server to store any corresponding information specific to that user. You should also make sure that your unique identifiers are not simple sequences. If I login, see my cookie "visitor_id" is set to 3, I could change it to "2" and now be some other user.

-Lenny