Hacking Session Variables??

I have a php MySQL CRM site with plenty of sensitive
information..
To protect this, I have a session based login system.
Login page - checks password and assigns Username, UserGroup
and Workgroup to session variables.
Restricted pages - checks usergroup access level and
workgroup id.
I have heard that, if a hacker re-writes the cookie (didn't
know sessions created a cookie) he can fool the server into
thinking that he is using someone elses session and could therefore
view, edit and delete those records normally protected.
I know that Session data cannot be viewed or amended but this
could pose a huge security issue.
It has also been suggested that the user has to re-enter his
password on each page but this is both unusual and would be a real
pain for the user.
Is there a simple way round this?

.oO(RichardODreamweaver)
>I have a php MySQL CRM site with plenty of sensitive
information..
>
> To protect this, I have a session based login system.
>
> Login page - checks password and assigns Username,
UserGroup and Workgroup to
>session variables.
>
> Restricted pages - checks usergroup access level and
workgroup id.
>
> I have heard that, if a hacker re-writes the cookie
(didn't know sessions
>created a cookie)
The session ID can also be appended to the URLs, but using a
cookie is
the preferred and considered the more secure way.
>he can fool the server into thinking that he is using
someone
>elses session and could therefore view, edit and delete
those records normally
>protected.
Just some keywords for further reading:
Hijacking a session by stealing the cookie usually requires
an XSS
attack (cross-site scripting). Try Wikipedia or Google for
details and
how to prevent that problem. This should be the first task,
because XSS
vulnerabilities are quite common and often the basis for many
other
kinds of attacks, including the following.
Another not so known attack is called session fixation. The
following
paper goes quite into detail about it:
http://www.acros.si/papers/session_fixation.pdf
> I know that Session data cannot be viewed or amended but
this could pose a
>huge security issue.
>
> It has also been suggested that the user has to re-enter
his password on each
>page but this is both unusual and would be a real pain
for the user.
Agreed. The user would never come back. But it's quite common
in bigger
systems that the user has to re-enter the password before
performing a
critical action, for example before placing an order in a web
shop or
when changing his personal data.
> Is there a simple way round this?
Security is never simple. It just depends on how much
security is
needed.
Micha

Similar Messages

Direct database request and session variable value

Hi,
I have a problem by doing the following : idea is to have report with a list of all tables in user schema (which are not all in repository physical layer).
By clicking on the name of any, should bring answer report which is done as direct database request doing basically select * from table_clicked (this will be basically the same table with sufix _err holding error rows).
What I'm trying to do is having some kind report for error rows which can be in different tables in my database. So i had in mind to construct name of table i need , and pass it to database request through session variable. Am i doing right by doing direct database request like this :
select * from 'VALUEOF(NQ_SESSION.TestVar2)'
Is there another easyer way of doing this? I know this can be done by gourl by passing parameters but not sure how when i can't filter columns in direct database request (this can be different tables with different names of columns). I hope i didn't complicated this too much.
Thnx in adwance

Hi,
I know this is a hack, and would be much more easy to create one table with dimension and measures, but this is intended to be used with code generator, which can produce different error tables with different column names in different time: It is not conviniet for somebody to add them to repository every 5 minutes. For example : i run my workflow and for first run I have errors in table1(let us say customer table with 30 columns) and if click on the table name in some answer report, i want to see all the bad records in the table. Tomorrow after the run, there are bad records in table1 and in table2 (lets say products) so I would have choice to pick table 1 or table2 and see al the bad records in any of these tables. This means that I can not now which tables will I have tomorrow, and as it is generic, I can manually add some tables in my model, and would have to add err table also as a possibility to have error rows?
I saw post saying that you can pass parameter value by using go url functionality, by modifying configinstance file, but didn't suceed - http://gerardnico.com/wiki/dat/obiee/logical_sql/obiee_session_variable_go_url . Maybe some mistake or any better solution? I created session variable TestVar2, also modified instanceconfig.xml by adding this before </ServerInstance>
<ParamList>
<Param name="NQ_SESSION.TestVar2" source="url" nameInSource="SETVAR"/>
</ParamList>
and used go url in column formula : ''||"Physical Targets"."Physical Table"||''
Can I use @1 for using first column value?
Thnx

Servlet/PHP Session Variables

Hello Everyone,
I am running an servlet that requires authentication. The authentication is done by a PHP program, while the heavy lifting is done by a servlet. How do I pass a session variable from my php to my servlet so that my servlet knows the user is allowed. I have tried
Object done = session.getAttribute("loggedIn");
with "loggedIn" being set by my php file, but done is always null. Any help is greatly appreciated especially if it is cookie free.
Sincerely,
Chem E

You could consider the following solution: on click of the link, fire a specific Ajaxical request from the server where PHP runs to the server where Java runs to obtain an lengthy and unique key which expires within a few seconds, use JS+DOM to add that key as a query parameter to the link value and after opening the link let the Java side determine the key and handle accordingly.
You only need to write code so that it is hack safe.

To pass new session variable value to stored proc before running a report.

Hi,
Below is summary of the report requirement -
Database level design
1. Created a view and a global temporary table (GTT)
2. Created an Oracle package procedure to accept from and to business dates on basis of which it will fetch, process and populate the GTT.
Repository level design
1. Created a business model containing the view and the GTT (mentioned above)
2. Created two SESSION variables "from_dt" and "to_dt" to be initialized by their respective init blocks. Each of the variable is initialized with a DATE column value (of type DATETIME) from a database lookup table. I have also set the option "Enable that variable to be set by any user" for both variables.
Query for these variables :
from_dt = select from_date from <table>
to_dt = select add_months(from_date,12) from <table>
Presentation level design
1. Using a text box, i display the default/initialized values of these variables like this -
Current business date:@{biServer.variables['NQ_SESSION.from_dt']} Future business dt:@{biServer.variables['NQ_SESSION.to_dt']}
Dates get displayed in YYYY-MM-DD 00:00:00 format
The text msg displays these default dates and allows the user to specift different date range for which i create prompts as shown below.
2. Using any random two columns of date type from the business model, i create two date dashboard prompts with labels "From Dt" and "To Dt".
i select Calender Controls for both; setting Default To = Report Defaults.
The Set Variable is set to Presentation variables - such that pv_from_dt maps to "From Dt" and pv_to_dt maps to "To Dt".
3. i create the report using the business model created above. In the report "Advanced Tab" => "Prefix" field i specify the following -
SET VARIABLE from_dt='@{pv_from_dt}',to_dt='@{pv_to_dt}';
Note : The logic here is to display the default dates and allow user to specify different date values which will be stored in presentation variables.
If the user does specify different "from dt" and "to dt" values, then using the presentation variables, i want to "write" back these new values to the corresponding session variables mentioned above.
If the user does not specify different date range, then the default/initialized dates must be considered.
I also display the default and new date values in the report title.
Back to Repository level design
To execute the stored procedure that will load the GTT before running the report I need to pass two date parameters to the stored procedure on basis of which it will fetch data, process and populate the GTT.
In the Connection Pool --> Connection Script Tab --> Execute before query, I wrote the below query using the repository variables FROM_DT and TO_DT to execute the procedure -
DECLARE
v_from_dt date;
v_to_dt date;
BEGIN
v_from_dt := VALUEOF(From_Dt);
v_to_dt := VALUEOF(To_Dt);
package_name1.package_body(v_from_dt,v_to_dt);
END;
Now when i try to run the report i get the following error :
[nQSError: 10058] A general error has occurred. [nQSError: 23006] The session variable, NQ_SESSION.to_dt, has no value definition. (HY000)..
Need help on this.
Is it possible to "write back" a new value to a session variable ?
Any other alternatives.
Thanks
Nusrat
Edited by: user10309945 on Jan 24, 2011 10:08 PM

Sandeep, I found a several topics where users describe saving values in DB through stored procedure or function. For example, [How to store OBIEE presentation level variable values in DB |http://forums.oracle.com/forums/thread.jspa?threadID=892006] I tried it and get an error
*10058. [NQODBC] [SQL_STATE: HY000] [nQSError: 10058] A general error has occurred. [nQSError: 17001] Oracle Error code: 14551, message: ORA-14551: cannot perform a DML operation inside a query ORA-06512*
It's not a BI error. This error are generated by Oracle DB. If I write next:
SELECT MyPLSQLFunction(p1,p2) FROM DUAL
I get the same error.
Oracle doesn't allow DML operations in SELECT.
Did you relalize this feature yourself? Where did I mistake?

Session variable size limitation (LV Webservices)

Hi community,
I read couple dozen email addresses from an XML and trying to write them into a session variable. The email addresses are comma separated and have a total string length of about 1100 characters. When I try to write it into a session variable LabVIEW drops an error message (-67158).
It is very clearly related to the size of the string as if use lets say only 200 characters I dont receive the error message.
How can I get rid of this limitation?
Thanks!

I am writing a general purpose webpage where I need email notifications. I have the workaround ready (before I send out the emails I dont read the emails from a session, but using the userID stored in the session to read the email from the xml). But generally having this limitation is annoying and unnecessary as normally you easily can store 100kB in one session. (probably even more, but that was the max I have ever did)

Trying to move a list of form variables to session variables of the same name

I am trying to move a list of form variables to session variables of the same name and I am having a lot of trouble.
I have never had to post of this forum with a language question in all the 10 years I have been using ColdFusion. I was a qa Engineer @ Allaire/Macromedia back when it was going from one to the other. I have a pretty good grasp of the language.
I have software that runs off a list. The fieldnames are variable and stored off in an array. It's survey software that runs off a "meta file". In this example; I have the number of fields in the survey set to 12 in the "metafile". I have each field declared in that file in array Session.SurveyField[1] and the above loop works fine. I include this "metafile" at the start of the process.
I cfloop around a struct and it works wherever I have needed to use it; such as here - writing to the database for example;
<CFQUERY NAME="InsertRec" DATASOURCE="Survey">
INSERT into #variables.SurveyTableName#
(EntryTime
<cfloop from="1" to="#Session.NumberOfSurveyFields#" index="arrayindex">
,#Session.SurveyField[arrayindex]#
</cfloop>

   VALUES
    ('#EntryTime#'
<cfloop from="1" to="#Session.NumberOfSurveyFields#" index="arrayindex">
<cfset thisname = "Session." & Session.SurveyField[arrayindex]>
,'#evaluate(variables.thisname)#'
</cfloop>

</CFQUERY>
NOW HERE'S THE PROBLEM: I am running into trouble when trying to move the form variables to session variables of the same name. It is the only part of the software that I still need the datanames hard coded and that is a roadblock for me.
<cfloop from="1" to="#Session.NumberOfSurveyFields#" index="arrayindex">
<cfset thissessionfield = "Session." & Session.SurveyField[arrayindex]>
<cfset thisformfield = "Form." & Session.SurveyField[arrayindex]>
<cfset #thissessionfield# = #evaluate(thisformfield)#>
</cfloop>
I have tried it with or without the "evaluate"; same result. It doesn't give an error; it just ignores them (session variables look as such in the next page in the chain)
q01_name=
q02_acadtechorna=
q03_water=
q04_firstaid=
q05_cpr=
q06_lifeguard=
q07_aed=
q08_projadv=
q09_color=
q10_santaclaus=
q11_supervisor=
q12_supervisoropinion=
Note: they exist because I CFPARAM them in a loop like the above at the start of the procedure) - and this works just fine!
<cflock scope="Session" type="EXCLUSIVE" timeout="30">
<cfloop from="1" to="#Session.NumberOfSurveyFields#" index="arrayindex">
<cfset dataname = "Session." & Session.SurveyField[arrayindex]>
<cfparam name="#variables.dataname#" default="">
</cfloop>
</cflock>
I EVEN tried exploiting the Form.Fieldnames list using CFLoop over the list and the same sort of logic within and it still gives me nothing....
Here's the FORM.FIELDNAMES value
"Q01_NAME,Q02_ACADTECHORNA,Q03_WATER,Q04_FIRSTAID,Q05_CPR,Q06_LIFEGUARD,Q07_AED,Q08_PROJAD V,Q09_COLOR,
Q10_SANTACLAUS,Q11_SUPERVISOR,Q12_SUPERVISOROPINION"
Here's the logic; SAME RESULT - The session variables don't get set.
<cfoutput>
<cfloop list="#Form.FieldNames#" index="thisfield">

<cfscript>
thisSESSIONfield = "Session." & thisfield;
thisFORMfield = "Form." & thisfield;
#thisSESSIONfield# = #thisFORMfield#;
</cfscript>
</cfloop>
</cfoutput>
The CFPARAM in a loop with variable output name works just fine; so does the post (which I included above) as does the SQL Create, Param Form Variables, Param Session Variables, etc.
THIS even works for moving BLANK to each session variable, to zero them all out at the end of the process;
<cflock scope="Session" type="EXCLUSIVE" timeout="30">
<cfloop from="1" to="#Session.NumberOfSurveyFields#" index="arrayindex">
<cfset thislocalfield = Session.SurveyField[arrayindex]>
<cfscript>
thissessionfield = "Session." & thislocalfield;
</cfscript>
<cfset #thissessionfield# = "">
</cfloop>
</cflock>
Expanding on that code, you would think this would work, but it doesn't;
<cfloop from="1" to="#Session.NumberOfSurveyFields#" index="arrayindex">
<cfset thislocalfield = Session.SurveyField[arrayindex]>
<cfscript>
thissessionfield = "Session." & thislocalfield;
thisformfield = "Form." & thislocalfield;
</cfscript>


<cfoutput>
<cfset #thissessionfield# = "#evaluate(thisformfield)#">
</cfoutput>
</cfloop>
And see that debug code in the middle? To add insult to injury... When I uncomment that it shows me this. So it certainly looks like this should work....
Session.q01_name = "Me"
Session.q02_AcadTechORNA = "N/A"
Session.q03_Water = "Yes (certificate expired)"
Session.q04_FirstAid = "Yes (certificate is current)"
Session.q05_CPR = "No"
Session.q06_LifeGuard = "Yes (certificate expired)"
Session.q07_AED = "Yes (certificate expired)"
Session.q08_ProjAdv = "Yes (certificate expired)"
Session.q09_Color = "Gray"
Session.q10_SantaClaus = "Yes"
Session.q11_Supervisor = "Da Boss"
Session.q12_SupervisorOpinion = "Not a bad thing"
There must be some simpler way to do this. This way won't work against all odds even though it seems so much like it should.
So I end up having to hardcode it; still looking for an automated way to set these #@%$*@!## session variables over the list from the form variables of the same @#@!$#%$%# name. Do I sound frustrated???
No matter what I do, if I don't HARDCODE like this;
<cfset Session.q01_name = Form.q01_name>
<cfset Session.q02_AcadTechORNA = Form.q02_AcadTechORNA>
<cfset Session.q03_Water = Form.q03_Water>
<cfset Session.q04_FirstAid = Form.q04_FirstAid>
<cfset Session.q05_CPR = Form.q05_CPR>
<cfset Session.q06_LifeGuard = Form.q06_LifeGuard>
<cfset Session.q07_AED = Form.q07_AED>
<cfset Session.q08_ProjAdv = Form.q08_ProjAdv>
<cfset Session.q09_Color = Form.q09_Color>
<cfset Session.q10_SantaClaus = Form.q10_SantaClaus>
<cfset Session.q11_Supervisor = Form.q11_Supervisor>
<cfset Session.q12_SupervisorOpinion = Form.q12_SupervisorOpinion>
I always get this from my next page because the session variables are empty;
You must answer question 1.
You must answer question 2.
You must answer question 3.
You must answer question 4.
You must answer question 5.
You must answer question 6.
You must answer question 7.
You must answer question 8.
You must answer question 9.
You must answer question 10.
I tried duplicate as well, but I can not get the above to work...
Can anyone help me do this thing that one would think is simple????

I think if you use structure array syntax you should get the results you want.
<cfloop from="1" to="#Session.NumberOfSurveyFields#" index="arrayindex">
      <cfset session[Session.SurveyField[arrayindex]] = Form[Session.SurveyField[arrayindex]]>
</cfloop>
Or probably even easier.
<cfset session = duplicate(form)>

Can we use session variables in BI publisher's Data Model SQL Query?

Hi Experts,
We need to implement Data level security in BI Publisher 11g.
In OBIEE we do so by using session variables, so just wanted to ask if we can use the same session variables in BI Publisher as well
ie can we include the where clause in the Data Models SQL Query like
Where ORG_ID = @{biServer.variables['NQ_SESSION.INV_ORG']}
Let me know your views on this.
PS: We are implementing EBS r12 security in BI Publisher.
Thanks

Read this -> OBIEE 11g: Error: "[nQSError: 23006] The session variable, NQ_SESSION.LAN_INT, has no value definition." when Creating a SQL Query using the session variable NQ_SESSION.LAN_INT in BI Publisher [ID 1511676.1]
Follow the ER - BUG:13607750 - NEED TO BE ABLE TO SET A SESSION VARIABLE IN OBIEE AND USE IT IN BI PUBLISHER
HTH,
SVS

Compare data record to session variable

I am completely stumped. It should be easy.
I am trying to compare a field from a database to a sesssion variable on a JSP page and even though the fields print out the same when I call them in JSP, my "If" statement never gets activated.
Here's the last version of the code I tried:
String usernamev = UserSession.getValue("username").toString();
String custname = RS.getString("ORCUST");
if (usernamev.equals(custname))
userrole="Customer ";
I've also tried this:
String usernamev = UserSession.getValue("username").toString();
String custname = RS.getString("ORCUST").toString;
if (usernamev.equals(custname))
userrole="Customer ";
And I've also tried this:
if (RS.getString("ORCUST").equals(usernamev))
userrole= "Customer ";
And This:
And I've also tried this:
if (usernamev.equals(RS.getString("ORCUST")))
userrole= "Customer ";
When RILLI is the field I'm trying to compare this works:
if (usernamev.equals("RILLI"))
userrole= "Customer ";
Somehow my data type must be wrong but I can't figure out why. When I print out
<%=usernamev%>
and <%=RS.getString("ORCUST")%>
they show on my webpage as RILLI. I can also assign a constant value to userrole without a problem.
What the heck am I doing wrong?

I think limeybrit was on the right track and I hadn't trimmed because I got a no trim method error before because I hadn't converted session variable to a string.
When I used this:
String usernamev = UserSession.getValue("username").toString();
usernamev = usernamev.trim();
String custname = RS.getString("ORCUST").trim();
I think its working now. Thanks for help all.

Session variable getting reset when leaving dashboard

I have created a session variable with the 'Enable any user to set the value' option. I'm using the session variable as the default for a dashboard prompt. I'm able to set the variable with that dasboard prompt, and I can confirm that it is indeed getting set properly. So the interaction of the variable and the prompt seems to be in order.
After I make a selection from the dashboard prompt, as long as I stay in the dashboard, the session variable stays set to my selection. I can move from page to page and everything is fine. The selection stays put as I have set it. However, the moment I leave the dashboard, the session variable is reinitialized back to its default value as specified by the SQL in its initialization block. I can go from dashboard to catalog and back to dashboard - boom, it's back to the default. My selection has been replaced. ???
And here's an odd thing: I can look in the query log and see the initialization block code getting run when I log in. So far, so good. I can run the dashboard, make a prompt selection, and see the query log updated just fine. Still OK. BUT... when I switch from dashboard to catalog and back to dashboard, the value of the session variable is reset (I see the default month in my analysis and as the prompt default upon redisplay of the dashboard page), but there's no indication in the query log that the initialization block SQL ran again. The last SQL in the query log still shows my "selected" value in the SQL. The dashboard page is showing the "default", while the last entry in the query log shows the "selected".
Can anyone else confirm this odd behavior? And is there a reason that a session variable should not retain its value throughout the session? I've always viewed session variables as little buckets of single-cell data whose contents are consistent and static for the duration of a session, unless manually changed by a dashboard prompt. If the behavior that I'm seeing is both replicatable and expected, it would appear that my understanding is flawed.
Running 11.1.1.7.0 on Windows Server 2008. Same behavior is occurring in both Firefox 21 and IE 9.

Thank you for your answer MK,
I try to write a SQL in my prompt but not work for me:
-In default selection I choose SQL Results and I type: Year(Current_date) and save my prompt and I don't see any value in my dashboardpage, if I click in prompt I can see all members of my year dimension but by default is empty.
I modify the other solution: I have 1hour refresh time and I change for 1 minute, but doesn't work.
the default initializer is in RPD (variable year that belongs to BI_Year Block) and I have written 2009.

Urgent help required...for replacing JSP session variables

I am trying to enhance the performance of a j2ee based webapp which use session variables to store the data...
Is there any alternative for session variables..The project is based on j2ee-Struts frame work..But the amount of code maintainance should be minimum ....so i can't create beanforms for all these data...
Is there any XML based methods available...??

ok... thanks... i created a fla file and inthe action script
pasted the following code
var nc:NetConnection = new NetConnection();
nc.connect("rtmp://flash.ispstream.com/ondemand/unikron/my_video_dj/");
var ns:NetStream = new NetStream(nc);
contentMain.myVideo.attachVideo(ns);
ns.setBufferTime(5);
ns.play("dvd_r");
nothing is working if i tried to load... can u help me out

Passing attribute value in session variable

Hi All
I need to store one field value from my SIM form as a session variable and pass them to the next page along with my session, using some jscript stuff or else. Does this make sense?
If it is possible or anyone have any prior experience please reply.
Thanks in advance

We have tested a code-snippet that 'gets' attribute-values from the session:
<invoke name='getAttribute'>
    <invoke name='getHttpSession'>
        <ref>:display.state</ref>
    </invoke>
    <s>attribute_name</s>
</invoke>You can try 'setAttribute' in the similar way.
Thanks,
Adi

Javacard and session variables

Hello,
I'm trying to find a reasonable Javacard technique to handle "session variables" that must be kept between successive APDUs, but must be re-initialized on each card reset (and/or each time the application is selected); e.g. currently selected file, currently selected record, current session key, has the user PIN been verified...
Such variables are best held in RAM, since changing permanent (EEPROM or Flash) variables is so slow (and in the long run limiting the operational life of the card).
Examples in the Java Card Kit 2.2.2 (e.g. JavaPurseCrypto.java) manipulate session variables in the following way:
1) The programmers group session variables of basic type (Short, Byte, Boolean) according to type, and map each such variable at an explicit index of a vector (one per basic type used as session variable).
2) At install() time, each such vector, and each vector session variable, is explicitly allocated as a transient object, and this object is stored in a field of the application (in permanent memory), where it remains across resets.
3) Each use of a session variable of basic type is explicitly translated by the programmer into using the appropriately numbered element of the appropriate vector.
4) Vector session variables require no further syntactic juggling, but eat up an object descriptor worth of permanent data memory (EEPROM or Flash), and a function call + object affectation worth of applet-storage memory (EEPROM, Flash or ROM).
The preparatory phase goes:
public class MyApp extends Applet {
// transientShorts array indices
    final static byte      TN_IX = 0;
    final static byte      NEW_BALANCE_IX=(byte)TN_IX+1;
    final static byte      CURRENT_BALANCE_IX=(byte)NEW_BALANCE_IX+1;
    final static byte      AMOUNT_IX=(byte)CURRENT_BALANCE_IX+1;
    final static byte   TRANSACTION_TYPE_IX=(byte)AMOUNT_IX+1;
    final static byte     SELECTED_FILE_IX=(byte)TRANSACTION_TYPE_IX+1;
    final static byte   NUM_TRANSIENT_SHORTS=(byte)SELECTED_FILE_IX+1;
// transientBools array indices
    final static byte      TRANSACTION_INITIALIZED=0;
    final static byte      UPDATE_INITIALIZED=(byte)TRANSACTION_INITIALIZED+1;
    final static byte   NUM_TRANSIENT_BOOLS=(byte)UPDATE_INITIALIZED+1;
// remanent variables holding reference for transient variables
    private short[]     transientShorts;
    private boolean[]   transientBools;
    private byte[]      CAD_ID_array;
    private byte[]      byteArray8; // Signature work array
// install method
    public static void install( byte[] bArray, short bOffset, byte bLength ) {
         //Create transient objects.
        transientShorts = JCSystem.makeTransientShortArray( NUM_TRANSIENT_SHORTS,
            JCSystem.CLEAR_ON_DESELECT);
        transientBools = JCSystem.makeTransientBooleanArray( NUM_TRANSIENT_BOOLS,
            JCSystem.CLEAR_ON_DESELECT);
        CAD_ID_array = JCSystem.makeTransientByteArray( (short)4,
            JCSystem.CLEAR_ON_DESELECT);
        byteArray8 = JCSystem.makeTransientByteArray( (short)8,
            JCSystem.CLEAR_ON_DESELECT);
(..)and when it's time for usage, things go:
    if (transientShorts[SELECTED_FILE_IX] == (short)0)
        transientShorts[SELECTED_FILE_IX] == fid;
    transientBools[UPDATE_INITIALIZED] =
        sig.verify(MAC_buffer, (short)0, (short)10,
            byteArray8, START, SIGNATURE_LENGTH);I find this
a) Verbose and complex.
b) Error-prone: there is nothing to prevent the accidental use of transientShorts[UPDATE_INITIALIZED].
c) Wastefull of memory: each use of a basic-type state variable wastes some code; each vector state variable wastes an object-descriptor worth of permanent data memory, and code for its allocation.
d) Slow at runtime: each use of a "session variable", especially of a basic type, goes thru method invocation(s) which end up painfully slow (at least on some cards), to the point that for repeated uses, one often attain a nice speedup by caching a session variable, and/or transientShorts and the like, into local variables.
As an aside, I don't get if the true allocation of RAM occurs at install time (implying non-selected applications eat up RAM), or at application selection (implying hidden extra overhead).
I dream of an equivalent for the C idiom "struct of state variables". Are these issues discussed, in a Sun manual, or elsewhere? Is there a better way?
Other desperate questions: does a C compiler that output Javacard bytecode make sense/exists? Or a usable Javacard bytecode assembler?
Francois Grieu

Interesting post.
I don't have a solution to your problem, but caching the session variables arrays in local variable arrays is a good start. This should be only done when the applet is in context, e.g. selected or accessed through the shareable interface. This values should be written back to EEPROM at e.g. deselect or some other important point of time. Do you run into problems if a tear happens? I don't think so since the session variables should be transactional, and a defined point will commit a transaction.
Analyzing the bytecode is a good idea. I know of a view in JCOP Tools (Eclipse plugin) where you can analyze the bytecode and optimize it to your needs.

Session variable

I created a period status session variable which i want to use as a filter in answers. This variable takes note of the last closed period (month - YYYYMDD) when the accounting team closes it in their books. I currently have open periods taking the values of the last closed period and so the client wants these open periods to be removed from the report until the period in closed with accounting hence the use of a filter on the period (month) column. I used this filter eg Time."Fiscal Period" <= VALUEOF(NQ_SESSION."CURR_PER_OPEN") but it is producing this message:
The specified criteria didn't result in any data. This is often caused by applying filters that are too restrictive or that contain incorrect values. Please check your Request Filters and try again. The filters currently being applied are shown below.

Hi,
Try it like this..
Set the default using logical SQL. Select <presentation table>.<presentation
column> from <subject area> where
<presentation table>.<presentationation column> =
valueof(NQ_SESSION.<session variable>)
http://gerardnico.com/wiki/dat/obiee/set_request_variable_dashboard_prompt
http://sureshotstrategies.blogspot.com/2008/07/about-session-variables-in-obiee.html
Thanks
Deva

Using Session Variables for User Login - sometimes they don't persist... what am I doing wrong?

Hi all,
I'm running a site that requires user login. I approached the building of this site as almost a complete newb to CF (and dynamic coding in general), and it's been a great learing experience (with lots of help from you guys).
However, I guess I never learned the correct way to handle a user login. It seemed to me that I could just test the user-entered credentials against those stored in a database, then set a session variable containg that user's record number. Then, not only would I have an easy way of knowing who this user was and therefore what info to serve him, but I could test for the existence of a valid login on every page in the protected folder, by adding this code to my application.cfc in that folder:
<cfset This.Sessionmanagement=true>
<cfset This.Sessiontimeout="#createtimespan(0,8,0,0)#">
   <cfif NOT isDefined ("session.username") or NOT isDefined ("session.password") or NOT isDefined ("session.storeID")>
     <cflocation url="../index.cfm" addtoken="no">
   </cfif>
...and it goes on to run a query and verify that the session.username and session.password match for the store defined by session.storeID. If not, all session variables are cleared and it bounces you back to the login page. When the user clicks Logout, all I do is delete all the session variables.
This seemed to work great for like a year, but lately I've been getting reports that the login doesn't seem to persist for longer than approx. 20 minutes of inactivity. You can see I specified session variables to remain active for 8 hours (I know that seems like a drastically long login, but it's what's necessary for this application). I've only gotten this report from a few people, and I myself can't seem to duplicate it... I've tested an inactive login for 45 minutes now and it held.
SO: any reason you can think of why session variables would be spontaneously clearing for some people? Would having your router reset its IP address invalidate the session or something? Also, the problem seemed to begin appearing after my host upgraded all their servers to CF9... could there be any relation?
And on a more general note... did I go about this completely the wrong way to begin with? If so, what's the standard way to manage a login?
Lots of questions, I know... thanks very much for any answers or suggestions!
Joe

Ian,
Thanks very much - very helpful information.
Sounds like passing the tokens in every request is probably the way to go for this. I don't think it's likely that any users will be sharing links, unless they actually intend for the recipient to see their info anyway.
Is that all I would have to do, is add the tokens to every path? Would that guarantee that all the session variables would remain valid until timeout or being cleared?
Again, thanks, you've been really helpful.
Joe
On Jun 23, 2010 4:37 PM, Ian Skinner <[email protected]> wrote:
Unfortunately this is the nature of HTTP web applications. There is NO state maintained from HTTP request to request. This is by design in the HTTP protocol specifications.
ColdFusion provides two methods to circumvent this limitation. Each method has limitations and caveats. They both rely on the passing of tokens between the client and the server with every request. These tokens can be passed as cookies OR URL (GET) variables. You are using the cookie method, which is the simpler and most common. You may be experiencing the limitation of this method. If something happens to the cookies the session can be lost.
You could pass the (CFID & CFTOKEN) OR JESSIONID tokens through the URL query string with every request. This requires one to add these values to every link, form action, cflocation or other request path in our application. ColdFusion provides the session.urltoken variable to make this easier to do. The tokens will be visible to the user. Also if the links with an individual token is share with other users, via e-mail, chat, social networks, etc and one of these users utilize the link during the life of a session (8 hours apparently in your case). Then that user will access the session of the original user.
Cookie session management is by far the most common choice by CF developers. If these methods do not meet your needs you would need to go beyond the HTTP limitations of web applications. One might be able to accomplish this with a Flex|Air|Flash applications that can be configured to use a continuous connection to the server. Thus not suffer the stateless nature of the normal HTTP request-response cycle.
I do not know if a router resetting would cause cookies to be discarded or otherwise invalidated. But I would not think it is beyond the relm of possibilities.

Session variable and initialization block issues

We are using OBIEE 10.1.3.3 and utilizes built in security features. (No LDAP or other single sign on). The user or group names are not stored in any external table. I have a need to supplement Group info of the user to the usage tracking we implemented recently as the NQ_LOGIN_GROUP.RESP column contains username instead of group name. So I created a session variable and associated with a new initialization block and also had a junk default value set to the variable. In the initialization block, I wrote the following query and as a result it inserted correct values into the table when the TEST button was clicked from the initialization block form.
insert into stra_login_data (username, groupname, login_time) values ('VALUEOF(NQ_SESSION.USER)', 'VALUEOF(NQ_SESSION.GROUP)', SYSDATE)
My intention is to make this execute whenever any user logs on. The nqserver.log reports the following error and it doesn?t insert values into the table.
[nQSError: 13011] Query for Initialization Block 'SET_USER_LOGIN_BLOCK' has failed.
[nQSError: 23006] The session variable, NQ_SESSION.USER, has no value definition.
[nQSError: 13011] Query for Initialization Block 'SET_USER_LOGIN_BLOCK' has failed.
[nQSError: 23006] The session variable, NQ_SESSION.GROUP, has no value definition.
When I changed the insert statement as below, this does get populated whenever someone logs in. But I need the values of GROUP associated with the user as defined in the repository.
insert into stra_login_data (username, groupname, login_time) values ('TEST_USER', TEST_GROUP', SYSDATE)
Could someone help me out! As I mentioned above, I need the GROUP info into the usage tracking. So, if there is another successful approach, could you please share?
Thank you
Amin

Hi Amin,
See [this thread|http://forums.oracle.com/forums/thread.jspa?messageID=3376946&#3376946]. You can't use the GROUP session variable in an Init Block unless it has been seeded from an Init Block first. There isn't an easy solution for what you want, but here are some options:
1) Create a copy of your User => Groups assignments in your RPD in an table so you can use it in your Usage Tracking Subject Area. But this means you will have to replicate the changes in two places so it's not a good solution.
2) As the GROUP session variable is populated when you login you could theoretically use it a Dashboard and pass it a parameter to write the value to the database. But as I am not sure how can you make fire only once when the user logins it sounds like a bad idea.
3) Move your User => Groups assignments from your RPD to a DB table. Use OBIEE Write Back or something like Oracle APEX to maintain them.
I think 3) is the best solution to be honest.

Hacking Session Variables??

Similar Messages

Maybe you are looking for