How to get a user to register on my site for several months?

Question

I am using OpenID. How can I make it so that the user logs in for a long time even after closing the browser window?

How to save and access a user object of a user?

Basically, I think I just don’t understand how sessions work in Java.

Answer 1

So, you really want the "Remember me on this computer" option? This is not actually related to the OpenID part. Here's a language-agnostic way how you can do this:

• First, create a database table with columns of at least cookie_id and user_id . If necessary, also add cookie_ttl and ip_lock . The column names speak for themselves, I think.

• When logging in for the first time (if necessary, only with the "Remember Me" option), generate a long, unique, hard-to-reach key (which is in no way connected with the user), which represents cookie_id and saves it to the database along with user_id . Store cookie_id as a cookie value with a known cookie name, e.g. remember . Give your liver a long life, for example. one year.

• In each request, check if the user is logged in. If not, check the cookie_id value associated with the cookie remember name. If it is, and it is valid according to the database, then automatically log in to the user associated with user_id and user_id cookie age again, and if there is also cookie_ttl in the database.

In Java / JSP / Servlet conditions, use HttpServletResponse#addCookie() to add a cookie and HttpServletRequest#getCookies() to receive cookies. You can perform all the first checks in Filter , which listens for the necessary resources, for example. /* or perhaps a little more limited.

As for sessions, you do not need it here. It has a shorter life than you need. Use it only to enter a registered user or a “found” user when he has a valid remember cookie. In this way, Filter can simply check its presence in the session and then do not need to check cookies every time.

It's pretty straightforward. Good luck.

See also:

• How to implement "Stay logged in" when a user logs into a web application
• How do servlets work? Create, Sessions, Shared Variables, and Multithreading

Answer 2

Well, the original reason I chose OpenID was that someone else could handle the same implementation and authentication security for me.

Having looked at OpenID more, a bit of an “immediate request” appears ( http://openid.net/specs/openid-authentication-2_0.html#anchor28 ).

When requesting authentication, the relying party MAY request that the OP does not interact with the end user. In this case, the OP MUST immediately respond either with an assertion that the authentication is successful, or with a response indicating that the request cannot be completed without additional user interaction.

Because of this, I think I can just save the openID user url in a cookie and use an immediate request to check if the user is authenticated. This way, I don’t have to do anything with my database or implement any logic to prevent the session from being captured by a long-lived cookie.

This way of doing this, apparently, in the way that OpenID offers to do this with its best practice document .