OXSessionLifecycle - Revision history

Khgras: Replaced content with "The content on this page has moved to https://documentation.open-xchange.com/7.10.3/middleware/login_and_sessions/session_lifecycle.html Note: Open-Xchange is in the proc..."

2019-11-18T10:57:11Z

Replaced content with "The content on this page has moved to https://documentation.open-xchange.com/7.10.3/middleware/login_and_sessions/session_lifecycle.html Note: Open-Xchange is in the proc..."

Show changes

217.6.212.138: /* Creating a session */

2011-05-23T13:19:03Z

Creating a session

← Older revision		Revision as of 13:19, 23 May 2011
Line 10:		Line 10:
	Host: localhost		Host: localhost
	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1		User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
	Content-Type: application/x-www-form-~~urlenblockquoted~~; charset=UTF-8		Content-Type: application/x-www-form-urlencoded; charset=UTF-8

	name=username%40contextname&password=somePassword		name=username%40contextname&password=somePassword
Line 37:		Line 37:
	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1		User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

	The User-Agent header is also used in constructing the cookie names used, or more ~~blockquotecisely~~ the '''Cookie Hash'''.		The User-Agent header is also used in constructing the cookie names used, or more precisely the '''Cookie Hash'''.

	name=username%40contextname&password=somePassword		name=username%40contextname&password=somePassword
Line 53:		Line 53:
	{"session":"4bb7202edae54094855b5a545d7123c3","random":"fd367d5c15ca4914b280982422008c4d","modules": '''/* SOME STUFF */''' }		{"session":"4bb7202edae54094855b5a545d7123c3","random":"fd367d5c15ca4914b280982422008c4d","modules": '''/* SOME STUFF */''' }
	0		0
	~~</blockquote>~~

	The answer provides the client with the two parts it later needs to construct valid requests: The '''Session Secret''' and the '''Session ID'''. As you can see in this line, the session secret is transferred as a cookie:		The answer provides the client with the two parts it later needs to construct valid requests: The '''Session Secret''' and the '''Session ID'''. As you can see in this line, the session secret is transferred as a cookie:

217.6.212.138: /* Creating a session */

2011-05-23T13:17:11Z

Creating a session

← Older revision		Revision as of 13:17, 23 May 2011
Line 11:		Line 11:
	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1		User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
	Content-Type: application/x-www-form-urlenblockquoted; charset=UTF-8		Content-Type: application/x-www-form-urlenblockquoted; charset=UTF-8

	name=username%40contextname&password=somePassword		name=username%40contextname&password=somePassword

Line 65:		Line 66:
	{'''"session":"4bb7202edae54094855b5a545d7123c3"''',"random":"fd367d5c15ca4914b280982422008c4d","modules": /* SOME STUFF */ }		{'''"session":"4bb7202edae54094855b5a545d7123c3"''',"random":"fd367d5c15ca4914b280982422008c4d","modules": /* SOME STUFF */ }

	This '''session id''' will later be sent to the server in all requests as the '''session''' parameter.		This '''session id''' will later be sent to the server in all requests as the '''session''' parameter.

	== Using a session ==		== Using a session ==

217.6.212.138: changed formatting

2011-05-19T14:51:22Z

changed formatting

← Older revision		Revision as of 14:51, 19 May 2011
Line 102:		Line 102:
	One of the first things the frontend does after having been loaded by your browser is trying to revive a possibly existing session. For this, the frontend issues the autologin call:		One of the first things the frontend does after having been loaded by your browser is trying to revive a possibly existing session. For this, the frontend issues the autologin call:

	~~<blockquote>~~		GET /ajax/login?action=autologin&modules=true&client=com.openexchange.ox.gui.dhtml&version=6.20.0%20Rev7 HTTP/1.1
	GET /ajax/login?action=autologin&modules=true&client=com.openexchange.ox.gui.dhtml&version=6.20.0%20Rev7 HTTP/1.1 ~~<br />~~		User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 ~~<br />~~		Cookie: JSESSIONID=0eb494cd2f364f9092596dba3c1ab33b.OX1; open-xchange-secret-2H65ETpH7sX1kOWi6eyw=d4da87aaddf04ae8a1194715b08eede6; '''open-xchange-session-2H65ETpH7sX1kOWi6eyw=4bb7202edae54094855b5a545d7123c3'''
	Cookie: JSESSIONID=0eb494cd2f364f9092596dba3c1ab33b.OX1; open-xchange-secret-2H65ETpH7sX1kOWi6eyw=d4da87aaddf04ae8a1194715b08eede6; '''open-xchange-session-2H65ETpH7sX1kOWi6eyw=4bb7202edae54094855b5a545d7123c3''' ~~<br />~~
	~~<br />~~		HTTP/1.1 200 OK
	HTTP/1.1 200 OK ~~<br />~~		Date: Thu, 19 May 2011 12:47:42 GMT
	Date: Thu, 19 May 2011 12:47:42 GMT ~~<br />~~		Expires: Sat, 06 May 1995 12:00:00 GMT
	Expires: Sat, 06 May 1995 12:00:00 GMT ~~<br />~~		Content-Type: text/javascript; charset=UTF-8
	Content-Type: text/javascript; charset=UTF-8 ~~<br />~~		Pragma: no-cache
	Pragma: no-cache ~~<br />~~		Cache-Control: post-check=0, pre-check=0
	Cache-Control: post-check=0, pre-check=0 ~~<br />~~		Keep-Alive: timeout=5, max=99
	Keep-Alive: timeout=5, max=99 ~~<br />~~		Connection: Keep-Alive
	Connection: Keep-Alive ~~<br />~~		Transfer-Encoding: chunked
	Transfer-Encoding: chunked ~~<br />~~
	~~<br />~~		976
	976 ~~<br />~~		{'''"session":"4bb7202edae54094855b5a545d7123c3"''',"random":"eebfe64f606447d6a64d26cacff35976","modules": /* SOME STUFF */
	{'''"session":"4bb7202edae54094855b5a545d7123c3"''',"random":"eebfe64f606447d6a64d26cacff35976","modules": /* SOME STUFF */ ~~<br />~~
	~~<br />~~
	~~</blockquote>~~

	Note the cookie containing the '''Session ID''', this cookie, formerly set by the 'store' call, is used to retrieve the session. If a session could be found it is returned, much like a regular login response.		Note the cookie containing the '''Session ID''', this cookie, formerly set by the 'store' call, is used to retrieve the session. If a session could be found it is returned, much like a regular login response.
Line 132:		Line 129:
	Finally, and for completeness sake, a session can be closed by issuing a 'logout' request:		Finally, and for completeness sake, a session can be closed by issuing a 'logout' request:

	~~<blockquote>~~		GET /ajax/login?action=logout&session=4bb7202edae54094855b5a545d7123c3 HTTP/1.1
	GET /ajax/login?action=logout&session=4bb7202edae54094855b5a545d7123c3 HTTP/1.1 ~~<br />~~		Host: localhost
	Host: localhost ~~<br />~~		User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 ~~<br />~~		Content-Type: application/x-www-form-urlencoded
	Content-Type: application/x-www-form-urlencoded ~~<br />~~		Cookie: JSESSIONID=0eb494cd2f364f9092596dba3c1ab33b.OX1; open-xchange-secret-2H65ETpH7sX1kOWi6eyw=d4da87aaddf04ae8a1194715b08eede6; open-xchange-session-2H65ETpH7sX1kOWi6eyw=4bb7202edae54094855b5a545d7123c3
	Cookie: JSESSIONID=0eb494cd2f364f9092596dba3c1ab33b.OX1; open-xchange-secret-2H65ETpH7sX1kOWi6eyw=d4da87aaddf04ae8a1194715b08eede6; open-xchange-session-2H65ETpH7sX1kOWi6eyw=4bb7202edae54094855b5a545d7123c3 ~~<br />~~
	~~<br />~~		HTTP/1.1 200 OK
	HTTP/1.1 200 OK ~~<br />~~		Date: Thu, 19 May 2011 12:47:52 GMT
	Date: Thu, 19 May 2011 12:47:52 GMT ~~<br />~~		Expires: Sat, 06 May 1995 12:00:00 GMT
	Expires: Sat, 06 May 1995 12:00:00 GMT ~~<br />~~		Content-Type: text/javascript; charset=UTF-8
	Content-Type: text/javascript; charset=UTF-8 ~~<br />~~		Pragma: no-cache
	Pragma: no-cache ~~<br />~~		Cache-Control: post-check=0, pre-check=0
	Cache-Control: post-check=0, pre-check=0 ~~<br />~~		Set-Cookie: open-xchange-secret-2H65ETpH7sX1kOWi6eyw=b6727314bd3949579859ee8f327b24dd; expires=Thu, 01-Jan-1970 00:00:10 GMT; path=/
	Set-Cookie: open-xchange-secret-2H65ETpH7sX1kOWi6eyw=b6727314bd3949579859ee8f327b24dd; expires=Thu, 01-Jan-1970 00:00:10 GMT; path=/ ~~<br />~~		Set-Cookie: open-xchange-session-2H65ETpH7sX1kOWi6eyw=09f43d699b2946808afefe667c91580b; expires=Thu, 01-Jan-1970 00:00:10 GMT; path=/
	Set-Cookie: open-xchange-session-2H65ETpH7sX1kOWi6eyw=09f43d699b2946808afefe667c91580b; expires=Thu, 01-Jan-1970 00:00:10 GMT; path=/ ~~<br />~~		Set-Cookie: JSESSIONID=0eb494cd2f364f9092596dba3c1ab33b.OX1; expires=Thu, 01-Jan-1970 00:00:10 GMT; path=/
	Set-Cookie: JSESSIONID=0eb494cd2f364f9092596dba3c1ab33b.OX1; expires=Thu, 01-Jan-1970 00:00:10 GMT; path=/ ~~<br />~~		Content-Length: 0
	Content-Length: 0 ~~<br />~~		Keep-Alive: timeout=5, max=90
	Keep-Alive: timeout=5, max=90 ~~<br />~~		Connection: Keep-Alive
	Connection: Keep-Alive ~~<br />~~
	~~</blockquote>~~


	Notice that the session secret cookie and the session id cookie are removed.		Notice that the session secret cookie and the session id cookie are removed.

217.6.212.138: changed formatting

2011-05-19T14:48:49Z

changed formatting

Show changes

DerCisco at 13:58, 19 May 2011

2011-05-19T13:58:49Z

Show changes

DerCisco: Created page with "= Lifecycle of an OX Session = This page describes in detail how a session is created, the components of a session and how they work together and which stages a session goes thr..."

2011-05-17T14:02:05Z

Created page with "= Lifecycle of an OX Session = This page describes in detail how a session is created, the components of a session and how they work together and which stages a session goes thr..."

New page

= Lifecycle of an OX Session =

This page describes in detail how a session is created, the components of a session and how they work together and which stages a session goes through during its existence.

== Creating a session ==

Creating a session is a very straight forward process. Let's fire up a network sniffer and see what's exchanged between client and server during login (redacted for brevity, some of the stuff that's sent back and forth is not really relevant to our discussion):

<pre>
POST /ajax/login?action=login&modules=true&client=com.openexchange.ox.gui.dhtml&version=6.20.0%20Rev7&authId=eedc7ddf-8c4b-4ba4-b00d-88250574eee1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Content-Type: application/x-www-form-urlenpred; charset=UTF-8

name=username%40contextname&password=somePassword
</pre>

Let's go through this one thing at a time. Look at the first line:

<pre>
POST /ajax/login?action=login&modules=true&client=com.openexchange.ox.gui.dhtml&version=6.20.0%20Rev7&authId=eedc7ddf-8c4b-4ba4-b00d-88250574eee1 HTTP/1.1
</pre>

It's an HTTP POST that wants to do a login ( /ajax/login?action=login ).

<pre>
POST /ajax/login?action=login&modules=true&'''client=com.openexchange.ox.gui.dhtml'''&version=6.20.0%20Rev7&authId=eedc7ddf-8c4b-4ba4-b00d-88250574eee1 HTTP/1.1
</pre>

The first thing we have to look at is the client identifier (&client=...). The client identifier is '''com.openexchange.ox.gui.dhtml'''. The client identifier is used to differentiate between different client programs that use the same cookie store. For example one session in your browser is opened by the OX frontend and another one by a browser plugin. In order for the cookies used in session handling not overwriting each other, each client program provides its own client identifier, that is later used to construct the cookie names by way of the '''Cookie Hash'''.

<pre>
POST /ajax/login?action=login&modules=true&client=com.openexchange.ox.gui.dhtml&version=6.20.0%20Rev7&'''authId=eedc7ddf-8c4b-4ba4-b00d-88250574eee1''' HTTP/1.1
</pre>

The second thing that jumps out is the Auth-ID and the Auth-ID that will show up in log files is '''eedc7ddf-8c4b-4ba4-b00d-88250574eee1'''. Whenever you have to track a login or logout request among different systems of your apache / OX server cluster, for example, the Auth-ID will come in handy. It's a unique String that shows up on the requests way through the systems.

<pre>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
</pre>

The User-Agent header is also used in constructing the cookie names used, or more precisely the '''Cookie Hash'''.

<pre>
name=username%40contextname&password=somePassword
</pre>

This line contains the parameters sent in the POST request. "name" is set to username@contextname, and the password is set to "somePassword". This information will be used by the authentication system to authenticate the user or deny the login request. Let's say everything goes right with our login attempts and look at the servers answer, again redacted for brevity and relevance to our discussion:

<pre>
HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Set-Cookie: open-xchange-secret-2H65ETpH7sX1kOWi6eyw=d4da87aaddf04ae8a1194715b08eede6; expires=Tue, 24-May-2011 13:28:59 GMT; path=/
Transfer-Encoding: chunked

90e
{"session":"4bb7202edae54094855b5a545d7123c3","random":"fd367d5c15ca4914b280982422008c4d","modules": '''/* SOME STUFF */''' }
0
</pre>

The answer provides the client with the two parts it later needs to construct valid requests: The '''Session Secret''' and the '''Session ID'''. As you can see in this line, the session secret is transferred as a cookie:

<pre>
Set-Cookie: open-xchange-secret-2H65ETpH7sX1kOWi6eyw=d4da87aaddf04ae8a1194715b08eede6; expires=Tue, 24-May-2011 13:28:59 GMT; path=/
</pre>

Notice the name of the cookie, which always starts with '''open-xchange-secret-''' followed by the '''cookie hash''' that is normally calculated from the User-Agent header of the login request, and the value of the client parameter. The expiry time of the cookie is goverened by the cookie lifetime configuration parameter and whether '''autologin''' is permitted or not. As I tried this request on Tue, 17-May-2011, the cookie will live one week.

The '''Session ID''' is transmitted to the client in the response:

<pre>
{'''"session":"4bb7202edae54094855b5a545d7123c3"''',"random":"fd367d5c15ca4914b280982422008c4d","modules": /* SOME STUFF */ }
</pre>

This '''session id''' will later be sent to the server in all requests as the '''session''' parameter.

== Using a session ==

== Storing a session for autologin ==

== Retrieving a session with autologin ==

== Session hibernation for long running sessions ==