De-authenticating users with multiple active sessions

Question

Hi guys,
I haven't posted much, but I've lurked for a long time and, until now, always found
the answer to my questions, but this one has me stumped. I've implemented the
Session Timeout utility successfully,
but I would like to add another function that would exchange a transaction_id between
the user and the server, as mentioned
Re: diallow multiple logins.
When I try to use this new function, the initial cookie gets set and the value is
inserted into the table. However, when I try to navigate to a second page, the value
in the cookie is not the same as the value in the table. When I keep all of the records
and compare them to all of the set-cookie calls, it appears that the
table is being updated more often than the cookies. I would really appreciate some
input on this problem or another way to validate that the user is active in
only one session.
Thanks,
Art
This is the process to create the initial cookie on Page 101-->
declare
  l_magic_number number;
  l_new_number number;
begin
  select to_number(to_char(sysdate, 'WDDHHMISS')) into l_magic_number from dual;
  dbms_random.seed(l_magic_number);
  l_new_number := dbms_random.random;
  delete from transaction_cookies where trans_user = owa_cookie.get('LOGIN_USERNAME_COOKIE').vals(1);
  insert into transaction_cookies (trans_user, transaction_id)
                  values (owa_cookie.get('LOGIN_USERNAME_COOKIE').vals(1), l_new_number);
  owa_cookie.send(
      name    => 'HTMLDB_SESSION_TRANSACTION',
      value   => to_char(l_new_number),
      expires => null,
      path    => '/',
      domain  => null
end;And the validation function is here-->
function check_transaction_id return boolean as
cursor c_select_number(user_name varchar2) IS
        select transaction_id
        from   transaction_cookies
        where  trans_user = user_name;
l_cookie_exists   boolean       := true;
l_selected_number number;
l_cookie_number   number;
l_new_number      number;
user_id        varchar2(256);
begin
    if htmldb_custom_auth.get_user is null then
        return true;
    end if;
    begin
        l_cookie_number := to_number(owa_cookie.get('HTMLDB_SESSION_TRANSACTION').vals(1));
        exception when no_data_found then
            l_cookie_exists := false; -- no cookie set, assume first page visit after login
    end;
    user_id := owa_cookie.get('LOGIN_USERNAME_COOKIE').vals(1);
    open  c_select_number(user_id);
    fetch c_select_number into l_selected_number;
    close c_select_number;
    if l_cookie_exists and l_cookie_number <> l_selected_number then
        delete from transaction_cookies where trans_user = user_id;
        OWA_COOKIE.REMOVE(
            name    => 'HTMLDB_SESSION_TRANSACTION',
            val   => to_char(l_cookie_number),
            path    => '/');
        wwv_flow.g_unrecoverable_error := true;
        owa_util.redirect_url('f?p='||wwv_flow.g_flow_id||':'||l_invalid_session_page);
        return false;
    elsif not g_other_cookie_already_sent then
        select to_number(to_char(sysdate, 'WDDHHMISS')) into l_magic_number from dual;
        dbms_random.seed(l_magic_number);
        l_new_number := dbms_random.random;
        delete from transaction_cookies where trans_user = user_id;
        insert into transaction_cookies values(user_id, l_new_number);
          /* The timeout function opened the HTTP header...*/
        owa_cookie.send(
            name    => 'HTMLDB_SESSION_TRANSACTION',
            value   => to_char(l_new_number),
            expires => null,
            path    => '/',
            domain  => null
        owa_util.http_header_close; /* Since this is called after the timeout function, THIS one will close the header*/
        g_other_cookie_already_sent := true;
    end if;
    return true;
end check_transaction_id;

Answer 1

Art - Thanks for the detailed problem description (with code). The problem you're seeing is due, in part, to the fact that an application's session verification function is run on every page show and page submit. Based on your function's logic, when you show a page, a cookie is sent (after you purge the table and do an insert). Then you submit the page and it runs again, purging the table, inserting a new value into the table, and sending that value in the cookie. Then the page branches to the next page (usually doing a URL redirect. Here's where it messes you up. Whenever a redirect is done, apex clears the HTTP header, so the cookie doesn't get to your browser. When the next show page request is handled (as a result of the branch), the function checks if the browser's cookie matches the value in the table. It doesn't.
The solution will involve having the function not do its thing if a page "submit" is being processed. There might be better ways to detect this but here is some could you could try:    if owa_util.get_cgi_env('REQUEST_METHOD') = 'GET' and
       lower(owa_util.get_cgi_env('PATH_INFO')) = '/f' then ......which would be true for show requests only (f?p URLs). I have to tell you though, that with some of the newer request types (ppr pagination, csv/fop output, on-demand/ajax invoked processes, ...), you may have to tinker quite a bit.
Also, in your code I see you use the LOGIN_USERNAME_COOKIE cookie to identify the user. This will not be reliable if a user is using the same browser to run more than one application. You really should use v('APP_USER') to identify the user (authenticated or not). And if your user is running multiple apps in the same browser, your other cookie needs a name unique to the application lest one app's cookie overwrites the other's.
Scott