custom session handling?

[gr2m]

I have several issues with Hoodie using cookies for sessions at the moment. One being, that I cannot end the session if the user is offline, but there are valid use cases for that, see hoodiehq/hoodie#194

There are other reason, including security flaws, why I'd suggest to have that changed.

Instead of using cookies, I'd like to send a custom header with every request, something like X-Hoodie-Session-Id.

Does CouchDB support something like that? Or would that mean that we have to build our own session/auth handler?

[janl]

On 06.12.2013, at 13:39, Gregor Martynus notifications@github.com wrote:

I have several issues with Hoodie using cookies for sessions at the moment. One being, that I cannot end the session if the user is offline, but there are valid use cases for that, see hoodiehq/hoodie#194

Can you not send a bogus cookie on the next connection?

There are other reason, including security flaws, why I'd suggest to have that changed.

That would imply that CouchDB sessions have security flaws which I don't think they do :) what issues are you referring to? (Please reply in private to this in order to ensure responsible disclosure.)

Instead of using cookies, I'd like to send a custom header with every request, something like X-Hoodie-Session-Id.

Does CouchDB support something like that? Or would that mean that we have to build our own session/auth handler?

There is the proxy handler that we might be able to hijack, but not sure at the moment.

—
Reply to this email directly or view it on GitHub.

[gr2m]

Can you not send a bogus cookie on the next connection?

The Cookie header is http only, and cannot be accessed / overwritten from JS code, for security reasons.

That would imply that CouchDB sessions have security flaws which I don't think they do :) what issues are you referring to? (Please reply in private to this in order to ensure responsible disclosure.)

done.

[svnlto]

I believe we have already implemented a solution for this?

[gr2m]

yes, we have bearer token now, we don't use Cookies anymore. So closing this.