maintaining state without a cookie

Question

I am trying to figure the workings of an IPB forum.

If I tick remember me, then I will remain logged in even if I close the browser and reopen it.

I am trying to workout how this is possible, as the only cookies that are set by the server expire at the end of the session, i.e. when I close my browser. So how does the server no how to resume the session, without using cookies?

edit: The session id cookie is set to expire at the end of the session, and I have my browser set to delete cookies at the end of the session.

This means when I close my browser(the session ends), the cookie should be deleted.

During the time my browser is closed, if I open up the same site in a different browser, surely the session should be resumed? This does not happen however.

Instead, if I open up my original browser, the session resumes.

The only other cookie set is a cookie called pass_hash, which expires as soon as it is created, and is sent by the server everytime a page is loaded. SO it would not be being used for authentication.

Answer 1

It sounds to me like you just missed a cookie (or misread/misunderstood when it expires), but the alternate possibility might be that it's keeping the remote address stored in the DB and automatically creating a new session for it for the second visit. However, this would be a rather poor solution both security-wise and due to NATs, et cetera - so I doubt that's what IPB does.

Answer 2

Normally cookies last after you close the browser. If you are using PHP, check out set_cookie's options, or if you are using sessions, check out the session area.

// Set Cookie
setcookie($name, $value, $expire) 
// $expire is the time in seconds since Unix Epoch (see [time()][3]) it will stay alive
// Session
session_set_cookie_params($lifetime) 
// $lifetime is the seconds it will stay alive in seconds

Answer 3

The session information isn't necessarily destroyed when the browser window is closed. In PHP, for example, you can choose to save session information in a database and you could persist that after the browser is closed and the original session is ended.

Another way I can think of is setting a flag on the Users table stating that the user is still logged in. Perhaps the table has a field called logged_in and you can set that to true. After a certain amount of time [ie, you don't come back] it would be reset back to false.

Answer 4

There are a few places to hide session information other than cookies.

a session key in the URL (http://example.com/app/234348738790/main)

a session key as a GET variable ( ?sess=257892345 )

a session key as a POST variable (input type='hidden')

store it in local storage in the browser

use javascript with any of the above to communicate the session info back to the server.

Answer 5

A sneaky alternative to cookies is the last-modified timestamp in an image or other object. The server can give you an image setting the timestamp to a value that identifies your session. When you load another page the browser sends an if-modified-since timestamp and gives you away.