* Michael Schuerig <michael@...> [2008-06-11 02:30]:
> Authentication information is usually enough.

Then you don’t need to store anything on the server. There is no
need for a session at all. Either use HTTP Auth or, in case you
are talking to a browser, use a cookie like this:

auth_token = concat( username, ":", expiration_datetime );
msghash = digest_hmac( concat( server_secret, ":", auth_token ) );
cookie = concat( msghash, ":", auth_token );

With this scheme, cookies cannot be forged because generating
a correct message hash requires knowledge of the server secret
that is not part of the cookie. So if the client sends you a
cookie whose hash checks out, you know it’s a cookie you minted
and you can therefore trust the username portion of the cookie.
Aside from the server secret, which is easily kept in memory,
you don’t need any information external to the cookie in order
to verify it: no on-disk session.


* Bruno Harbulot <Bruno.Harbulot@...> [2008-06-11 04:45]:
> I think this doesn't contradict the stateless interactions
> principle of REST, as long as the session is only used for
> authentication purposes.

Indeed it doesn’t.

Regards,
--
Aristotle Pagaltzis // <http://plasmasturm.org/>