plone.session 3.4

plone.session implements secure session management for Zope sites.<br />In its default configuration plone.session uses an HMAC SHA-256 secure cryptographic hash to authenticate sessions. The hash is generated using the userid and a secret stored in the PAS plugin. Otherwise, the cookie format is identical to that of Apache's mod_auth_tkt. For single sign on with the original mod_auth_tkt or another compatible implementation, set the mod_auth_tkt property to true. This invokes an MD5 based double hashing scheme. You will need to use the same secret across all servers.<br />This has several advantages over other session management systems:<br /> * passwords are not sent to the server in a cookie on every request, as is done by the Cookie Auth Helper<br /> * it does not require any ZODB write for sessions, as is needed by the Session Crumbler. This allows it to scale very well.<br /> * it allows you to invalidate all existing authentication cookies for users by updating the secret.<br /> * The cookie is only valid for the period specified by the timeout property.<br />There are some downsides to this approach:<br /> * if a user's password is changed or disabled session identifiers will continue to work, making it hard to lock out individual users.<br /> * a user must have cookies enabled.<br />

Requirements:	No special requirements
Platforms:	*nix, Linux
Keyword:	Across All,  Advantages,  Allows It,  Allows You,  An Md5,  Apache Mod,  As Is,  Auth Helper,  Auth Tkt,  Authenticate Sessions,  Authentication Cookies,  Based Double,  Compatible,  Existing,  Hmac,  Serversthis,  You Will Need,  Zodb,  Zodb Write,  Zope Sitesin
Users rating:	0/10