Community has the option to 'remember' the user even if the browser is closed and the user connects a week later. This is because a locally stored cookie contains a session ID which matches the session ID stored in the database the last time the user logged in (using the remember login option and a password)

This is fine for a single sign on scenario, and it's the preferred method of operation for almost every major internet portal out there, however, almost EVERY site that implements this also seems to protect specific pages, like, for example, the profile page. So, in the event the computer is compromised or the session is hijacked no major damage or sensitive information will be stolen since the local cookie will be 'ignored' (for security reasons)

What would be the best way to quickly implement this on a per page basis? or better yet. How I do protect: The GOCart plugin from displaying Billing/Shipping for returning customers, Profile page for GForum, profile page for Community.

Would a simple line to delete the locally stored cookie do? is this the way major sites implement this 'double check' ?

I've tried (sucesfully) experimenting with GOCart. GOCart sets a cookie called 'cid' so it's relatively easy to 'expire' the GComm Community_Name and Community_Session cookies when 'cid' is not present so every time the cart script is access for the first time a new session in GComm is created.

I've tried to get the Expires field from the cookie, to try and determine how long ago it was set for that particular user. However, it seems according to the specification that the expires field is only used by the client to determine if cookie info should be sent or not. And the expires field itself is never sent.

So, the GOCART issue is solved easily, but what about the profile page for GComm for example?

My problem is not actually 'how to' do it. since, expiring cookies or deleting sessions directly in the DB will do, horribly.. but it will do. The thing is that I don't have a way to tell the user's last login unless I get it from gcomm_session, something that seems expensive under a heavy load operation.

I'm just looking for ways to protect sensitive areas (profile page, GOCart) for users how have cookies expiring in 2005.

Ideas?

Unfortunately the only way to tell a remember me session vs a fresh one is by the length of the expiry. So you would need to get the current session, and if the expiry is too far into the future, force the user to re-authenticate themselves.

Cheers,

Alex
--
Gossamer Threads Inc.