Avoid multiple logon..
9 Message(s) by 7 Author(s) originally posted in java misc
| From: udupi_mail |
Date: Thursday, July 01, 2004
|
I've been reading all I can about Sessions and Tracking but in vain.
Herez the deal:
I've been using
cookie s for
session tracking . I had to resort to
cookies because httpsessions aren't feasible
since my env. is Websphere5 ND. There is no guarantee that the session
is replicated across
appliacation
servers in a clustered env.
The
real issue here is that need to ENSURE that a user doesn't
logon
more than once ..In simple avoid
multiple login. On a successful 2nd logon I'd like to terminateb I
know this can be achieved by doing a DB read on every
page forwards/action. I want to avoid DB dips since this will affect
the performance of my appln. By the way, I am using struts framework
for the web app.
Is there any other way , In which the above can be achieved?
TIA
Guru.
| From: Sudsy |
Date: Thursday, July 01, 2004
|
wrote in
message :
I have been reading all I can about Sessions and Tracking but in vain.
Herez the deal:
I've been using cookies for session tracking. I had to resort to
cookies because httpsessions aren't feasible
since my env. is Websphere5 ND. There is no guarantee that the session
is replicated across
appliacation servers in a clustered env.
<snip>
It was my understanding that this had already been
address ed. I know
that Tomcat can use a single DB for session
persistence across multiple
nodes (clustered servers) and I'd be very surprised if
IBM did not have
equivalent capabilities.
I'd
expect that the performance would not be impacted to a great
degree since multiple clients are the
norm for a DB.
| From: sks |
Date: Thursday, July 01, 2004
|
I have been reading all I can about Sessions and Tracking but in vain.
Herez the deal:
I've been using cookies for session tracking. I had to resort to
cookies because httpsessions aren't feasible
since my env. is Websphere5 ND. There is no guarantee that the session
is replicated across
appliacation servers in a clustered env.
The real issue here is that need to ENSURE that a user doesn't logon
more than once ..In simple avoid
multiple login. On a successful 2nd logon I'd like to terminateb I
know this can be achieved by doing a DB read on every
page forwards/action. I want to avoid DB dips since this will affect
the performance of my appln. By the way, I am using struts framework
for the web app.
Is there any other way , In which the above can be achieved?
How are you storing the login? Are you storing some customerId and password
hash in a cookie ?
| From: bcd |
Date: Thursday, July 01, 2004
|
In article
<795af78a.0407010539.5c58fca1@xxxxxxxxxxx>,
wrote in message:
Is there any other way , In which the above can be achieved?
It is unclear from your description why you can not use cookies.
Anyway, the poor man's cookie is one that gets embedded in all the
link s you provide on the web pages you serve, making sure that
whatever link the user clicks on, the
URL that ends up getting
requested contains your cookie information.
It's very crude though and has all sorts of problems of its own.
Cheers
Bent D
--
Bent Dalager - bcd@xxxxxxxxxxx -
http://www.pvv.org/~bcd
powered by emacs
| From: Paul Ilechko |
Date: Thursday, July 01, 2004
|
wrote in message:
I have been reading all I can about Sessions and Tracking but in vain.
Herez the deal:
I've been using cookies for session tracking. I had to resort to
cookies because httpsessions aren't feasible
since my env. is Websphere5 ND. There is no guarantee that the session
is replicated across
appliacation servers in a clustered env.
If you use session persistence there absolutely is such a guarantee.
The real issue here is that need to ENSURE that a user doesn't logon
more than once ..In simple avoid
multiple login. On a successful 2nd logon I'd like to terminateb I
know this can be achieved by doing a DB read on every
page forwards/action. I want to avoid DB dips since this will affect
the performance of my appln. By the way, I am using struts framework
for the web app.
Is there any other way , In which the above can be achieved?
This is absolutely not worth even attempting. So what if a user logs in
more than once? Trying to prevent it is going to lead you into a whole
mess of problems. Firstly, there is no connection between security login
and session
management - destroying the session doesn't log a user out
from a WAS security perspective, as the ltpa
token is still in the
browser and still valid. Secondly, what happens if a user's browser or
PC crashes? They have not logged out, but they have no security
credential. If you prevent them from logging in again because you think
they are still logged on you are going to
generate a whole bunch of
calls to your helpdesk. This is just a dumb idea.
| From: udupi_mail |
Date: Tuesday, July 06, 2004
|
Hello Paul,
Thanks for your response. I believe in my situation it'd make
perfect sense to avoid multiple logins by the same user. See we offer
live
streaming content over the
net and we don't want any user to
share his UID/PWD with others and abuse the
system . So there needs to
be a way that the last authenticated user retires/expires his previous
logon ( ..do I make sense? )
The only way I see this happening is with session persistance, which
I have heard to be very
memory intensive ..so any other options?
Anyways, thanks for all your responses.
TIA
Guru.
wrote in message
wrote in message:
> I've been reading all I can about Sessions and Tracking but in vain.
> Herez the deal:
>
> I've been using cookies for session tracking. I had to resort to
> cookies because httpsessions aren't feasible
> since my env. is Websphere5 ND. There is no guarantee that the session
> is replicated across
> appliacation servers in a clustered env.
If you use session persistence there absolutely is such a guarantee.
> The real issue here is that need to ENSURE that a user doesn't logon
> more than once ..In simple avoid
> multiple login. On a successful 2nd logon I'd like to terminateb I
> know this can be achieved by doing a DB read on every
> page forwards/action. I want to avoid DB dips since this will affect
> the performance of my appln. By the way, I am using struts framework
> for the web app.
>
> Is there any other way , In which the above can be achieved?
This is absolutely not worth even attempting. So what if a user logs in
more than once? Trying to prevent it is going to lead you into a whole
mess of problems. Firstly, there is no connection between security login
and session management - destroying the session doesn't log a user out
from a WAS security perspective, as the ltpa token is still in the
browser and still valid. Secondly, what happens if a user's browser or
PC crashes? They have not logged out, but they have no security
credential. If you prevent them from logging in again because you think
they are still logged on you are going to generate a whole bunch of
calls to your helpdesk. This is just a dumb idea.
| From: Ben_ |
Date: Tuesday, July 06, 2004
|
Hello,
If I understand your business context, you want to not loose money by
controlling logons. But what if a customer has legitimate reason to not
logout (system crash, like Paul stated) ?
I believe you must address this issue before looking at technical answers.
| From: Paul Ilechko |
Date: Tuesday, July 06, 2004
|
wrote in message:
Hello Paul,
Thanks for your response. I believe in my situation it'd make
perfect sense to avoid multiple logins by the same user. See we offer
live streaming content over the net and we don't want any user to
share his UID/PWD with others and abuse the system. So there needs to
be a way that the last authenticated user retires/expires his previous
logon ( ..do I make sense? )
The only way I see this happening is with session persistance, which
I have heard to be very memory intensive ..so any other options?
The guys at Palm had a really neat way to prevent this with their eBooks
downloads - you had to re-enter your verified credit
card number when
you logged in. Nobody is going to give away their credit card number
just so that other people can get free content.
| From: marcus |
Date: Thursday, July 08, 2004
|
Gurudev -- your first post and your
followup say entirely different
things. Your first post said "The real issue here is that need to
ENSURE that a user doesn't logon more than once" in very emphatic
language. the second said "we don't want any user to
> share his UID/PWD with others and abuse the system"
the second one is easy, and has many
solution s that don't involve
preventing duplicate logins so much as choosing how to react to them --
which, btw, is a marketing decision rather than a
programming decision.
One solution is to kill the existing connection on a new login. if he
gives away his pwd he screws himself. I've used this myself by
handing the connection off to another
servlet to manage, and it worked
extremely well in a
development environment.
alternately you can simply log the duplicate login
event and sweep the
logs for possible abuse, which is the most friendly
method because it
allows for human interpretation and interaction with the user.
You could prevent duplicate logins, but have the user
jump through a
hoop to reset (like in the case of a crash), like follow a link and
reply to an email. I had a system like this once where I had to make a
phone call and keypad my pin to reset the system and have a new pdw issued.
-- clh
wrote in message:
Hello Paul,
Thanks for your response. I believe in my situation it'd make
perfect sense to avoid multiple logins by the same user. See we offer
live streaming content over the net and we don't want any user to
share his UID/PWD with others and abuse the system. So there needs to
be a way that the last authenticated user retires/expires his previous
logon ( ..do I make sense? )
The only way I see this happening is with session persistance, which
I have heard to be very memory intensive ..so any other options?
Anyways, thanks for all your responses.
TIA
Guru.
wrote in message
wrote in message:
I've been reading all I can about Sessions and Tracking but in vain.
Herez the deal:
I've been using cookies for session tracking. I had to resort to
cookies because httpsessions aren't feasible
since my env. is Websphere5 ND. There is no guarantee that the session
is replicated across
appliacation servers in a clustered env.
If you use session persistence there absolutely is such a guarantee.
The real issue here is that need to ENSURE that a user doesn't logon
more than once ..In simple avoid
multiple login. On a successful 2nd logon I'd like to terminateb I
know this can be achieved by doing a DB read on every
page forwards/action. I want to avoid DB dips since this will affect
the performance of my appln. By the way, I am using struts framework
for the web app.
Is there any other way , In which the above can be achieved?
This is absolutely not worth even attempting. So what if a user logs in
more than once? Trying to prevent it is going to lead you into a whole
mess of problems. Firstly, there is no connection between security login
and session management - destroying the session doesn't log a user out
from a WAS security perspective, as the ltpa token is still in the
browser and still valid. Secondly, what happens if a user's browser or
PC crashes? They have not logged out, but they have no security
credential. If you prevent them from logging in again because you think
they are still logged on you are going to generate a whole bunch of
calls to your helpdesk. This is just a dumb idea.
Next Message: Hugely dumb questions...
Blogs related to Avoid multiple logon..
Re: dbimport EXTREMELY slow
(ON) > # 0 : cannot add logical
log on the fly.
... If dynamic logging is off, LTXHWM/LTXEHWM need to be set to smaller > values > # to
avoid long transaction
... The following are default settings for enabling
Java in the database.
...
Writing Java Guidelines by Using Citations from Established References
and to
avoid as much as possible writing the standards or guidelines "from
... use of enterprise services,
logon or security procedures, etc. that are
... Multiple citations. Some of the more universal topics are going to appear in many
...
New features added to Servlet 2.5
By using this annotation, you
avoid the need to make. a JNDI (
Java Naming and Directory
... or
, you can now provide multiple match criteria in the ... Selecting a default page after login: If users visit a servlet's ...
Apps Technical Interview Questions
To avoid the cost of licensing you may suggest the clients may decide to ... Question: You have written a Java Concurrent Program in Oracle Apps. You want to ... Next time when you logon to Oracle Apps Self Service, the Framework will ...
informatyk
It can download one file from multiple URLs or multiple connections from one URL. ... As a Java applet, MyVoIPSpeed Server is easily incorporated into Web pages ... Changes: A significant possible exposure of MySQL login info was fixed. ...
Swing and Roundabouts 1M: Emission DTs
This article might be debunked over time at this permalink on java.net CVS. ... 1P: Epoxy DTs looked at using dynamic proxies to avoid boiler-plate code to build ... a service for populating and enabling menus for users when they logon, ...