Forum Discussion

Wynand_van_Nisp's avatar
Wynand_van_Nisp
Icon for Nimbostratus rankNimbostratus
Feb 26, 2009

Is there a way to manage sessions?

Hi,

 

 

I am by no means an Irule expert and have tried for the last 2 days to get a request done for a client.

 

 

The basic requirement is to track client sessions using JSESSIONID and another header in the dataflow (OperatorID).

 

 

When a user logs in I can pickup the Jseesion ID and the Operator ID header. The client wants us to drop the first session and only allow the second one to work. This is to ensure that a hacker dioesnt steal your session etc.

 

 

I have tried using the session uie add/lookup commands but have no idea how to successfully drop the first session when a second user logs on.

 

 

Would it be better to create a array and store the infor in there?

 

 

Any ideas would be greatly appreciated.

 

 

Thenks in advance

 

Wynand

 

 

application delivery
dev
devops
iRules

4 Replies

Sort By
  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Feb 26, 2009
    Hi Wynand,

     

    I am a bit confused on your statements. Are you saying that you want to drop the first session the minute the second session comes in. Thus only one session at a time? I am assuming one session is one user?

     

     

     

    CB

     

     

     

  • Wynand_van_Nisp's avatar
    Wynand_van_Nisp
    Icon for Nimbostratus rankNimbostratus
    Feb 27, 2009
    Hi,

     

     

    That is correct. It is a banking application. The bank's security policy determines that if a session gets compromised it need to drop the first session. This way if someone gets hacked their session will be dropped and they need to re-logon again.

     

     

    If it was the otherway arround doing it with a session uie lookup will be easy.

     

     

    Hope you can help.

     

    Wynand
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Feb 27, 2009
    Hi Wynand,

     

     

    How do you want to define and track a session? How do you identify a session that's been compromised?

     

     

    Do you want to try to capture the username for logins and track that the session details (probably a cookie?) don't get re-used by another client? If so, is there a single page or known list of pages that clients submit their credentials to? Or do you want to make sure the session ID doesn't get presented by a different IP address? Or something altogether different?

     

     

    Aaron
  • Wynand_van_Nisp's avatar
    Wynand_van_Nisp
    Icon for Nimbostratus rankNimbostratus
    Feb 27, 2009
    Hi Hoolio,

     

     

    Currently the client wants us to track the Opersator ID which sits in the heard together with the JsessionID. When a second person logs on using the same OperatorId and the Jsession is different to the first user it must drop the first user.

     

     

    Hope it make sense.

     

     

    Wynand