Good point

Transient session cookie - dies when browser shuts down

Persistent-session-cookie - stored on client local disk, is times out by
server side lookups

Persistent Profile cookie - a token to say this browser at some point
visited our site (and what state they achieved)
I am not 100% clear on the ins and outs of this - security wise we cannot
put anything actionable in here, we can never trust it.  I need to work
through the truth table more carefully

Paul Brian
07540 456 115
paul@mikadosoftware.com
@lifeisstillgood
pbrian.mikadosoftware.com

On 21 May 2013, at 15:40, Michael Mulich <notifications@github.com> wrote:

In rhaptos2/repo/sessioncache.py:

> +""":mod:`sessioncache` is a standalone module providing the ability to
> +control persistent-session client cookies and profile-cookies.
> +
> +:mod:`sessioncache.py` is a "low-level" piece, and is expected to be used
> +in conjunction with lower-level *authentication* systems such as OpenID
> +and with "higher-level" *authorisation* systems such as the flow-control in
> +:mod:`auth.py`
> +
> +persistent-session
> +    This is the period of time during which a web server will
> +    accept a id-number presented as part of an HTTP request as a replacement for
> +    an actual valid form of authentication.  (we remember that someone
> +    authenticated a while ago, and assume no-one is able to impersonate them in
> +    the intervening time period)
> +
> +persistent-session cookie

Should this be the profile-session cookie? Or is that not defined here?

—
Reply to this email directly or view it on
GitHub<https://github.com/Connexions/rhaptos2.repo/pull/131/files#r4318058>
.

-- 


www.mikadosoftware.com

See your software improve with every change.