How to make a user access security certificate.

Question

I have a web application that I would like to allow persistent access to that is not dependent on the browser cookie system.

Is there something that will allow me to, upon the first user authentication, send the browser a certificate which the app can check for periodically or upon future returns to the site? Maybe some take on an SSL?

I would prefer some sort of PHP/JS solution but I could entertain other options as well. I can also dictate the browser that the user will use so a solution doesn't need to be browser specific.

Thanks,

Answer 1

I believe what you are looking for is PersistJS, a client-side JavaScript persistent storage library. It does not require the use of cookies.

If you need actual certificates, you should research the TLS protocol. TLS is the successor to SSL and support bilateral authentication (client certificates).

Answer 2

You may want to check out the opensource Forge project. It implements TLS in JavaScript and you can do neat things like store client-side certificates in local storage and use them for authentication when appropriate.

http://github.com/digitalbazaar/forge/blob/master/README

Something similar to what you may be trying to do is the WebID project. These two sites show a demonstration of WebID (which involves storing a client-side certificate locally and then using it to authenticate on another website). They use Forge:

https://webid.digitalbazaar.com/manage/

https://payswarm.com/webid-demo/

Since these sites are for demonstration purposes only, you will need to accept their self-signed SSL certificates to view them. No real personal information is required to try out the demos.