Question

Coming from the web development world, I'm used to having single sign-on and session timeout/redirection to a login page handled on the server side.

From a rich client perspective, how can this be handled in Flex on the client side?

Thanks in advance for any suggestions.

Joe.

Answer 1

Well, the current project I'm working on is using the Zend Framework on the server side. When I login, a Zend_Session is created and stored on the server in much the same way it would be with a standard PHP website. Each post from the Flex app to Zend_AMF would check for a current session and then respond accordingly.

Of course, the client app could handle ALL of the session processing, but from my security-minded view, only the server can safely and securely handle the login sessions and know if the client is logged in or not.

If the client were to handle it's own login validation and then the server just assume that if the client says it's allowed to perform an operation, just do it....well, it would be too easy for a client to be spoofed and cause a security hole in the entire process.

Of course, if you are not using a server-side database/system, and only using a local database then everything I just said can be deemed irrelevant.

Answer 2

Darren, thanks for the response.

I understand that the session processing needs to be handled on the server side. My question is, how do you manage things on the client side when the session expires on the server side? Do you throw an exception on the server side that you look for on the client side? How do you redirect the user to the login screen when the server session expires?

Thanks for the help.

Joe.

Answer 3

Well, this is handled multiple ways in my current app:

1. Any message to the server that requires the user to be logged in will fail with a specific response code that I then force the user into a logged-out state.
2. I also have a periodic message that goes off every minute and checks if the user is still logged in (of course, it only is triggered when the client app believes it is logged in). If it fails, it will force the app into a logged-out state.

Answer 4

The solution I am using, is quite similar to Darren Ehlers.

1. My application will receive and keep session_id from server (I use ROR).
2. The client will keep checking server-side with its session_id in a specific interval time (for my case, it's every 3 minutes) if server-side response in session-timeout, the application will be force to login page.

Hope this will give you some idea. :)