Cookies to remember login state, is it safe?

Hello,
For my web application I use "WWW-Authenticate", "BASIC realm=\"My website access\"" to get username and password from the visitor. This info is checked agains account info I have stored in registrants infofiles that are only accessible locally at the server. If this user's info matches the my stored info, I grant the user to enter my site.
If the visitor visits the next page generated by my server, this info appears to be sent again automatically and so I can check it again before showing the contents of the next page. That means I have to do some file-access each time a page is requested at my server. So this could be a lot of 'slow' file access.
Now I thougt to use cookies to reduce this file-access, by storing the login-state in a session cookie (storing the user's name). In that case I can first check if the concerning cookie-info is set (username is set) and in case it is set, I can skip the file-check part.
I was wondering if this is save way of working. Can't a client view and/or change the contents of such a cookie? For instance, can't a client build a browser-look-a-like and let it view/alter the cookies that it receives? Or perhaps there more simple ways to do that. If so, I imagine the client alters it's login-state (by setting the cookie contents itself) and can enter my site with another username of a registered user.
So, are cookies save enough for storing login states? Since cookies are data stored at the client side, so I assume the client has access to that data one way or the other?
Many thanks in advance.
Best regards,
Harry Postma.

I would be somewhat nevous storing any sensitive information in a Cookie. As you say, the client can get access to this information locally on their system, or there is the potential of someone capturing packets being able to view the cookie as well.
That being said, there is an interesting discussion on theserverside.com regarding secure login cookes that you may want to review: http://www.theserverside.com/common/printthread.tss?thread_id=23406

Similar Messages

How to remember login permanently

Hi,
I don't know what I have done wrong. Each time I close the browser, I need to login again. In other forums, there is a checkbox "Remember login info" (or something like that). What should I do to make Firefox 3.01 (on WinXP SP3) to remember my login info on forums.oracle.com?
Thanks in advance.

Of course I allow cookies, and my browser works OK with other forums. This forum remember my login status but forget it a little while after.
Thanks "SomeoneElse" for pointing me to the right thread discussing this issue. Although I make the question as answered but I am NOT satisfied. I would still prefer to have a checkbox to give me the choice of remembering the login info.
To the designer of the forum: so I assume the decision to force the login periodically is to enforce the security? If you ask people all the time the login, what would they do? I bet you most of them will use weak password.
Edited by: CarbonFiber on Sep 17, 2008 8:28 AM

Using cookies to remember the last 2 links visited

Hey everyone,
I am trying to use learn JSP and cookie. I am making a webpage, and it is suppose to remembers the last 2 links selected from the website.
Basically, there are a few radio buttons. The user is to pick one, press submit. I am trying to write a cookie to "remember" that action so that the next time that user comes, there should be a link that says these are the last 2 pages visited.
Having not much JSP experience, I would like some assistance in building this kind of a website. It is very simple (Just a table with 2 columns - left for menu, right for navigation).
I was wondering if someone could help me with this.
Thanks in advance.

Can anyone please give me some code samples how can i do that.And what prevents you from searching the web ?

Set cookie to remember user selection

Help needed. I need to set a cookie to remember a selection from a menu list exaclty like this UPS example:
http://www.ups.com/
However, I can't seem to find this exact code and was hoping to do this with javascript on an HTML page and without any server side code. Can this be done? I'd appreciate any help. Thanks.
John

I need to set a cookie to remember a selection I can't seem to find this exact code and was hoping to do this with javascript
learn how to fish:
http://www.google.com/search?q=javascript+set+cookie
Give a man a fish and you feed him for a day.
Teach a man to fish and you feed him for a lifetime.

Plugin-container should close when Firefox is closed otherwise cookies and active logins survive Firefox closing

plugin-container should close when Firefox is closed otherwise cookies and active logins survive Firefox closing
== This happened ==
Every time Firefox opened
== plugin-container has shipped

forget it, another Firefox process was stuck
not an issue
sorry
alb.m

ITunes still not remembering login details

Hello all,
Is anyone experiencing the fact that iTunes "STILL" does not remember login details for premium Podcasts? I put in the username and password, click the little "Remember Password" box, log out as a test and then, nothing. No remember jack. I was hoping that Apple would listen and fix this but alas they only care about what they care about.
Did anyone find a work around to this problem. Thanks in advance.

**Sigh**
To pay so much many and to get so little support.
How hard is it for Apple to fix this problem? I am sure the mods will come by and delete my post because I did not speak highly of Apple and the wonder and joy that they bring the world but how about simply making iTunes work as it is advertised? If it is supposed to remember a username and password, how about this? Apple if you are listening, is this toooo much to ask? To make your customers happy.

Login Stats "false-positive"?

This deals with login stats... (I've not done any coding yet - just trying to hypothesize first... but will use CF queries)
I'm sure there's a way to do this but can't quite figure it. I know it's easy enough to do a database row count or add the 'number fields' in a
database column for a total, but - how to do this without getting a "false positive" as per below?
Goal: To find the name of the school with the lowest number of Teacher logins.
The LoginCounter database field is set up as a 'number field' and adds an increment of 1 each time a teacher logs in to the site. (for my counter code
to work, this field starts with a default of 1). I have a SchoolName field in the TeacherID row, associating a Teacher with a school and, currently
there are 5 schools... I don't have to do any kind of table join - all fields are in one table.
No problem with pulling a total on the total number of logins of ALL teachers in ALL schools or All teachers in THIS school and then comparing this
number between the different schools.
But I can see more than one "false positive" per the following:
Say, there are 20 TeacherID in School_01 and 40 TeacherID in School_02. And say, totaling the LoginCounter column shows a total of 30 teacher logins
for School_01 and 50 teacher logins for School_02. By just adding up the total LoginCounter per school would show that School_01 has the lowest number
of teacher logins.
However, you have to take into consideration that some teachers may have only logged in once (or rather, none)... as well as considering that, say, 15
teachers out of 20 teachers in School_01 may have logged in a total of 30 times... when, at School_02, one teacher may have logged in 35 times along
with 5 of his colleagues logging in once apiece. In this scenario School_01 still has the lowest total of loggins but School_02 actually has the poorer
score of total teacher logins.
How would I average the number of teachers per school with the total number of schools with the number of logins per teacher to
obtain an accurate count of actual teacher logins? An "over-zealous" teacher, logging in way more numerous times than other teachers would throw the
final figure off...
Is it even possible to obtain an accurate comparison the way I have the database fields set up? I guess (the way I have it set up) I can only consider the LoginCounter fields that have only a "1" (the number of teachers who have never logged in) and get an average to compare between schools. But if all the teachers in a school have logged in numerous times, I'll have to find some kind of "representative number" based on some kind of average between the number of teachers in a school and (the part I can't figure) some kind of average of each teacher's login total.
In retrospect, after re-reading this before posting... I guess I have only two things here: (1) The total number of logins per school (disregarding an
'over-zealous' teacher and, (2) a count on teachers who have never logged in, compared between schools. I just don't know if I can get an accurate
count for "Lowest Number of Logins School" if all teachers in a school have logged in numerous times... Is there a way to get some kind of average, or rather some 'representative number' based on the number of teachers per school and each one's login total? Or, maybe each teacher's LoginCount doesn't even come into play here... (I know this sounds a bit confusing.)
- ed

Thanks for the responses, folks...
All of you are right about the LoginCounter not having to have a default of "1". I had forgotten that, when a participating school is set up, all teachers are set up with a unique "generic-basic unique login" name and password -- just to be able to login on "Training Day". They can change their name and password once they are in their admin section. Teachers who aren't there on "Training Day" are sent an email with instructions on logging in for the first time and changing their name and password. I guess what I'm saying is that, when a participating school 'comes on board', all the participating teachers are added to the database before they even start using the teacher admin section. Maybe it doesn't matter -- I just didn't want an empty or null value when each row is set up...
The login code is as follows, running on the 'validation page' upon login submit.
<cfif session.status IS "valid">
<cfoutput QUERY="getuser">
<cfif #LastLoginDate# NEQ #TodaysDateTime#>
    <cfset #newcount# = LoginCounter + 1>
    <cfquery datasource="#application.dsn#">
    UPDATE teacher_logon
SET
LastLoginDate=#TodaysDateTime#,
LoginCounter=#newcount#
WHERE AdminID = #AminID#
</cfquery>
<cflocation url="Teacher/index.cfm?TeacherID=#AdminID#" addtoken="Yes">
</cfif>
</cfoutput>
So... "0" + "1" = "1" ... I just wasn't sure, when I wrote the code, if this field could be left blank ("blank" + "1")... so, when the individual's row is first entered I put a default "1" here -- since, for training purposes they are already set up to go into the admin section with a pre-created name and password. I figured I could always subtract "1" from the individual's LoginCounter field for accuracy.
I think 12Roberts login ratio is probably what I'm looking for -- Login Ratio: A = total number of teachers and Z = teachers who have never logged in...... Login Ratio = A-Z. (In my existing case a field value of "1" would equal a teacher who has never logged in and a field value of "2" would be a teacher who has logged in once.) I know, I know -- Why don't I just make it complicated or something, LOL.)
I think I was over-blowing my question and 12Robots simple Login Ration is what I was looking. Thanks, 12Robots and, thanks to all for the input. I'm going to mark this post as 'solved' since, the way I have this set up, this ratio is about all I can do with a "lowest login school count".
Thanks again, folks...
- ed

Agent stuck in the login state ..

Hi,
one of agent is stuck in the login state . We are using the UCCE setup version-8.5. when i was trying to kill this agent session through PG CMD line (using procmon -->>>resetas Agent ID ) its showing "Agent already logged out or pending log out. AgentID=41332752" , but after doing this that agent not able to login on any Ext. error "showing this agent is alrady loged on". Any one kindly help me to come out from this issue. We are using CTI toll kit for agent login.

Hi,
If you get this message error "showing this agent is alrady loged on" only for one Extension.
Then you can deassociate and associate the device in th PG user for that phone.
I hope the issue you are talkin about the AgentID not able to login to any of the extension.
Then check in the t_Agent_Real_Time table for this agent's current state and the extension.
Login using the agentID in that extension and logout.
Regards,
Senthil

Safari Won't Remember Login + Passwords

Safari just won't remember login names and passwords for sites! Even though I fill in the info and check the box that asks to remember, it does not.
BTW, it works fine on my main user setup, but not on a secondary user.
I have deleted the Safari .plist preference files, the keychain access .plist files and deleted files within the Keychain Access application and restarted the machine. Problem still exists.
Can anyone help?
Frank

I am curious about this, too.
Before I delete any of the suggested files, will I have to re-enter my log in names and passwords?
Usually when Safari has a memory lapse, it doesn't recall both log in name and password. When I attempted to log in to this forum today, Safari remembered my log in name, but not my password. Is there an option for Safari or keychain to remember only log in names, but not passwords?
Safari will usually prompt me to add log in name and password the first time I create it for a new site, but not always. It didn't do this when I re-entered it today, but after I logged out, it allowed me to log back in without requesting log in or password.
Thanks in advance for any info on this.
Dave

Remember Login using cookies and javascript

Hello all,
This is an urgent request. Pls reply asap.
I have two jsps one in English and other in french. I need to implement a functionality to remember the username in both these jsps. I have a function written in javascript to check if the "remember me" checkbox is enabled and then remember the user name. But it is not working as expected. It remembers in one jsp and if i go to french jsp all the info is lost.
Can you pls help me? Sample code would help.
I guess the cookie works only for the jsps under certain folder path say en/jsp/.. and fr/jsp/..

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>Login Form</title>
</head>
<body>
<form name="login" method="post" action="Home.jsp">
Email : <input type="text" name="email" /><br />
Password : <input type="password" name="password"/><br />
<input type="checkbox" name="rememberChk" value="on" />Remember Me <br/>
<input type="hidden" name="remember" value="0"/>
<input type="button" value="Sumbit" onClick="submitForm()"/>
</form>
</body>
<script>
     <%
     String email="";
     String password="";
     Cookie cookies [] = request.getCookies ();//Get All Cookies from Client Device
     if (cookies != null){//Check cookies are available
          for (int i = 0; i < cookies.length; i++){
               if (cookies .getName().equals("password")){
                    password=cookies[i].getValue();//Password which is saved on cookie
                    break;
          for (int i = 0; i < cookies.length; i++){
               if (cookies [i].getName().equals ("email")){
                    email=cookies[i].getValue();//Email which is saved on cookie
                    break;
     }%>
     function submitForm()//Submit function with checkbox determined value
          if(document.login.rememberChk.checked)
               document.login.remember.value = 1;
          else
               document.login.remember.value = 0;
          document.login.submit();
     document.login.email.value="<%=email%>";
     document.login.password.value="<%=password%>";
</script>
</html>
login.jsp
<%@ page contentType="text/html; charset=iso-8859-1" language="java"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Home Page</title>
</head>
<body>
<a href="logout.jsp">Logout</a><br />
<%
     String email;
     String password;
     String remember;
     email = request.getParameter("email".toString());
     password = request.getParameter("password".toString());
     remember = request.getParameter("remember");
      *if Remember Checkbox is Checked
      *then Save Email and passwod into Cookie
      *and Add Cookies into response/Client Device
     if(remember.equals("1")){
          Cookie pass = new Cookie("password",password);
          Cookie emailAdd = new Cookie("email",email);
          //Setting maximum Expiry Date Of Cookies
          pass.setMaxAge(365);
          emailAdd.setMaxAge(365);
          //Make Persistent Cookie onto Client Device
          response.addCookie(pass);
          response.addCookie(emailAdd);
%>
<h4>Welcome - <%=email%> </h4>
Your password is : <%=password%> <br />
</body>
</html>
Home.jsp
<%@ page contentType="text/html; charset=iso-8859-1" language="java" import="java.sql.*" errorPage="" %>
<html>
<%
Cookie cookies [] = request.getCookies ();//Get All Cookies from Client Device
if (cookies != null){//Check cookies are available
     for (int i = 0; i < cookies.length; i++){
          if (cookies .getName().equals("password")){
               Cookie cookie = cookies[i];
               cookie.setMaxAge(0);
               response.addCookie(cookie);
               break;
     for (int i = 0; i < cookies.length; i++){
          if (cookies [i].getName().equals ("email")){
               Cookie cookie = cookies[i];
               cookie.setMaxAge(0);
               response.addCookie(cookie);
               break;
response.sendRedirect("login.jsp");
%>
</html>
logout.jsp

How to remember login password on a computer

Happy new year to all of you...
I had made a application which uses login and password for authentication..this is working fine..Now i want to give one option to remember the login and password for the specific computer..actually i dont have any idea on it..Plz give me some suggestion to solve this problem..i have used jsp for front end with struts framework..
Thanx in advance..
Gyan

This isn't hack safe. If one would hijack another user login, one could just change the username in the cookie value.
Better create a cookie with a long and autogenerated key or hash and store the key in a DB along the User ID. This makes the guessing for keys of another users hard. You can find here an example: [http://balusc.blogspot.com/2007/03/user-session-filter.html].

Crash Affecting only One Login - But Not in Safe Mode

I have an iMac (built-in iSight) that suddenly has problems with only ONE login (the other accounts on the machine work fine). The troubled login won't mount the desktop at all, even with the entire library folder removed. Ran DW utility, but that didn't help. The interesting thing is, if I boot in SAFE mode, the problem goes away.
What am I missing? If there's a problem with some bit of startup code, driver, etc., why is it only affecting one login?
I realize my info above is sketchy. Hoping it might be enough for somebody to offer a clue... thanks.

Hi, Lonestar.
An errant Startup or Login Item maybe the cause. In this case, it would likely be a Login Item defined in the affected account. My "Troubleshooting Startup and Login Items" FAQ can help you pin that down if such an item is causing the problem. Focus on the instructions concerning Login Items with the affected account.
Good luck!
Dr. Smoke
Author: Troubleshooting Mac® OS X
Note: The information provided in the link(s) above is freely available. However, because I own The X Lab™, a commercial Web site to which some of these links point, the Apple Discussions Terms of Use require I include the following disclosure statement with this post:
I may receive some form of compensation, financial or otherwise, from my recommendation or link.

Firefox is remembering logins and passwords even when I've set the options to clear them when I exit. I access confidential sites and do not like this. How can I turn off this feature?

I want all passwords, browsing history, everything to clear when I shut down. Currently, it maintains my logins for certain sites. Due the confidentiality of my work, I do not want this to happen. I went to options and set it to clear upon closing, but that is not working.

If you mean websites remembering you by saving cookies via session restore then you can try this.
You can set the pref <b>browser.sessionstore.privacy_level</b> to 2 (never) or 1 (non-HTTPS, default in Firefox 3 versions) on the <b>about:config</b> page to disable saving cookies via session restore.
* http://kb.mozillazine.org/browser.sessionstore.privacy_level
To open the <i>about:config</i> page, type <b>about:config</b> in the location (address) bar and press the "<i>Enter</i>" key, just like you type the url of a website to open a website.<br />
If you see a warning then you can confirm that you want to access that page.<br />

Safari: login data not remembered + login into this board here fails!

Hi there,
I am having 2 problems with Safari:
At first since a few days (or at least I started to notice it since that time) my login data to internet boards is no longer beeing remembered by Safari. I have to log in again and again each time i visit the forums.
I tried deleting the cookies and then even setting back Safari, but both didn't help.
I then wanted to post it here on the apple-discussions-board to get help, but the bad supprise was, that i cannot login to this board via Safari anymore! So I find myself here now in the uggly situation to post this here from my fathers PC, because with InternetExplorer on this PC i am able to log in. :/
I heared from other ppl on other Forums, that they have similar experiences, at least concerning the fact, that their login data is not remembered anymore for forums. Some say it occured since 10.5.6 .
It would be great if some1 official, could help me here, since it is concerning my private AppleID. But I am thankfull for any Help.
Here some more Info on what happens when i try to login into this board here:
After pressing sign in i am led to a dialogue that is made for creating a new account. The interesting thing there is, that there is neither entered an Apple ID there, nor a Text field, where i could enter one. The area to the right of "AppleID" is simply emptym, and next to it there is a link for logging out of this ID.
as said: thx for any help.. and happy new one (in some hours )

Hi there.
The issue that i cannot login here anymore is solved
It was exactly what iBod sugested in the first answer - i had a special letter (?) in my second name. I first didn't think of it because i thought he meaned the alias or AppleID.
I'll mark this topic as solved, and open a new one concerning the auto-login issue seperately, so noone gets confused.
cheers all

Macbook crashes after login, but fine in safe mode... please help!!

So, out of nowhere my trusty macbook a few seconds after my desktop appears the computer needs to restart screen scrolls down, and that's pretty much it, as far as i'm aware I haven't changed any permissions and as far as i can see there isn't a programme to blame, as mentioned safe mode is fine, this is how i'm able to write this, is there anything I can do from here to try and fix the problem with the regular login?
Thanks.
Will.

If it works in safe mode then that usually means there is something related to system files causing the problem or the installation of incompatible software or malfunctioning software. The simplest solution is to reinstall OS X as follows:
How to Perform an Archive and Install
An Archive and Install will NOT erase your hard drive, but you must have sufficient free space for a second OS X installation which could be from 3-9 GBs depending upon the version of OS X and selected installation options. The free space requirement is over and above normal free space requirements which should be at least 6-10 GBs. Read all the linked references carefully before proceeding.
1. Be sure to use Disk Utility first to repair the disk before performing the Archive and Install.
Repairing the Hard Drive and Permissions
Boot from your OS X Installer disc. After the installer loads select your language and click on the Continue button. When the menu bar appears select Disk Utility from the Installer menu (Utilities menu for Tiger, Leopard or Snow Leopard.) After DU loads select your hard drive entry (mfgr.'s ID and drive size) from the the left side list. In the DU status area you will see an entry for the S.M.A.R.T. status of the hard drive. If it does not say "Verified" then the hard drive is failing or failed. (SMART status is not reported on external Firewire or USB drives.) If the drive is "Verified" then select your OS X volume from the list on the left (sub-entry below the drive entry,) click on the First Aid tab, then click on the Repair Disk button. If DU reports any errors that have been fixed, then re-run Repair Disk until no errors are reported. If no errors are reported click on the Repair Permissions button. Wait until the operation completes, then quit DU and return to the installer. Now restart normally.
If DU reports errors it cannot fix, then you will need Disk Warrior and/or Tech Tool Pro to repair the drive. If you don't have either of them or if neither of them can fix the drive, then you will need to reformat the drive and reinstall OS X.
2. Do not proceed with an Archive and Install if DU reports errors it cannot fix. In that case use Disk Warrior and/or TechTool Pro to repair the hard drive. If neither can repair the drive, then you will have to erase the drive and reinstall from scratch.
3. Boot from your OS X Installer disc. After the installer loads select your language and click on the Continue button. When you reach the screen to select a destination drive click once on the destination drive then click on the Option button. Select the Archive and Install option. You have an option to preserve users and network preferences. Only select this option if you are sure you have no corrupted files in your user accounts. Otherwise leave this option unchecked. Click on the OK button and continue with the OS X Installation.
4. Upon completion of the Archive and Install you will have a Previous System Folder in the root directory. You should retain the PSF until you are sure you do not need to manually transfer any items from the PSF to your newly installed system.
5. After moving any items you want to keep from the PSF you should delete it. You can back it up if you prefer, but you must delete it from the hard drive.
6. You can now download a Combo Updater directly from Apple's download site to update your new system to the desired version as well as install any security or other updates. You can also do this using Software Update.

Cookies to remember login state, is it safe?

Similar Messages

Maybe you are looking for