session id cookie in gwt rpc

Question

Assuming I'm rolling my own session code, what's the right way to generate a unique and secure session id cookie in java.

Should I not be rolling my own but using something that's already been standardized?

I'm using gwt and the google app-engine platform.

How do I make sessions persist across browser/server restarts?

Answer 1

No, you shouldn't be rolling your own.

The session ID needs to be cryptographically random (not guessable from known sources). It's difficult to get this right yourself.

Answer 2

Ideally you should be relying on the underlying framework's session management features. Servlets & JSPs, Struts and Spring have this support, which you should use.

In the extremely rare case that you are writing your own framework with no underlying session management features to rely on, you could start with the java.security.SecureRandom class to begin with. Of course, don't reinvent the wheel here, for broken session management is the same as broken authentication.

Update

Given that you are using Google App Engine, you should rely on the session management features provided by the engine. It seems that it is not switched on by default.

Answer 3

Using Servlet Sessions in GWT

In the remote service implementation class:

String jSessionId=this.getThreadLocalRequest().getSession().getId();

In the client code:

String jSessionId=Cookies.getCookie("JSESSIONID");

Enabling_Sessions

appengine-web.xml

<sessions-enabled>true</sessions-enabled>