Is it possible to create a flash drive login system that does not use a client-side session / cookie?

Question

I am working on a flash application that will be used by a medical client. Their IT department is so closely related to security that it disables cookies and scripts on the network.

Fortunately, wtf forms were able to solve one of these problems by checking the input form on the server side.

However, I get into the login system. I implemented a flash login, but this apparently requires data on the client side, since I can not log in when testing in a browser with these functions disabled.

Is there a way to create a login with null data on the client side?

Thanks for the help.

Answer 1

Of course, you can do this without cookies. You just need to get authorization for each request.

Here is an example in a jar using only Basic HTTP Auth . If you are not using 100% of HTTPS time, then you should use Digest Auth , which is safe.

Answer 2

With such restrictions that do not have null data on the client side, you can pass a session token in the GET parameters for each link displayed on the html page.

Or you can only create POST views with a hidden input key (possibly more secure).

Answer 3

, PHP trans-sid, - session_id URL- , URL- (, ).

, @app.url_defaults @app.url_value_preprocessor, URL.

url_for, , . :

@app.url_defaults
def add_session_id(endpoint, values):
    if 'session_id' in values:
        # Allows to manually override the session_id, might not be wanted.
        return
    if g.session_id:
        values['session_id'] = g.session_id

@app.url_value_preprocessor
def pull_session_id(endpoint, values):
    g.session_id = values.pop('session_id', None)

, , - (, , , Redis, session_id, g.session_id = session_id_here.

g.session_id , url_for ?session_id=yoursessionid URL-. g.session_id .

, , , , url .

Answer 4

. HTTP. HTTP - , , .

, HTTP Basic Authentication over HTTPS, .