Comments (4)
Yes, seems like a good idea. Go for it :)
from vertx-web.
After some investigation client sessions are tricky to implement due to the fact that the store needs to access the context both to load the session cookie to the session object and to serialize back the session object to the cookie at the end of the request.
In order to keep the API simple and minimal we might need to refactor the session store interface otherwise we need to duplicate the cookie handler and session handler code.
from vertx-web.
Storing the sessionData
on a cookie is the same as using just a Cookie
. Assume the following scenario: you have a webshop application and user {userId: 1}
adds a book to the basket, you would then do: session.put('basket', [ 'item1' ])
and you expect that at the end of the request a cookie is sent to the client with: {userId: 1, basket: [ 'item1' ]}
, so what is the role of the session store?
To me it seems that this is exactly the same as:
context.response().addCookie(Cookie.create('session',
JSON.stringify({userId: 1, basket: [ 'item1' ]}))
Now if you do this, then you can totally skip the server side and add items to your session at the client side since clients can read and write cookies (is this is configured to be allowed).
So from the the server side all you need in fact is to read the cookie which is trivial:
context.getCookie('session').getValue()
In reply to your other comment about security, well if you're sending all your session data in a cookie then there is always a chance that it will expose private information, if you want to encrypt the data, that is also simple, starting from the example above:
context.response().addCookie(
Cookie.create('session',
someEncryptionFunction(JSON.stringify({userId: 1, basket: [ 'item1' ]})))
you just need to implement your encryption function with your preferred algorithm.
I don't think we should refactor the current API just to implement a NO-OP store @stephane-bastian WDYT?
from vertx-web.
Since there is no feedback on this issue I'll close it for now and it can be re-open if there is interest.
from vertx-web.
Related Issues (20)
- HttpContext.fail() does not release the connection when invoked in SEND_REQUEST phase
- WebClient: NPE on misformatted Date or Expires header HOT 1
- absoluteURI is null when host header is missing HOT 2
- Issue with POST request hanging indefinitely in Vert.x Web HOT 3
- CSRF validation fails because CSRFHandler updates the session AFTER the session is already flushed HOT 1
- SockJS Event Bus Bridge does not keep web sessions alive for clustered session managers
- When upgrade vertx4, the path cannot support colon, and vertx 3 is ok HOT 1
- Use the new `OAuth2AuthorizationURL` in `OAuth2AuthHandler.extraParams`
- Reduce heavy atomic operations on RoutingContextImplBase HOT 1
- Rx Version of OAuth2AuthHandler Handler fails to add scopes HOT 2
- Vertx web randomly returns 404 error for certain POST requests even though for other similar requests it returns 200 HOT 2
- ChainAuthHandlerImpl#postAuthentication throws NPE HOT 1
- BodyHandler should not be added before the ProxyHandler HOT 2
- after RoutingContext.reroute(), TimeoutHandler still occured HOT 1
- Request to add localstorage-functonalities HOT 1
- GraphQL: Combination of request batching and Automatic Persisted Queries fails HOT 1
- New web client expectation, result type differ from error type HOT 5
- Exeptionhandler not working correctly HOT 5
- HTTP 1.0 request causes "Unhandled exception in router" HOT 4
- Catch all error handler
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from vertx-web.