Web Security

[Danilo Del Fio]

Hy,
I have worked in a project that previewed the authentication on LDAP through JAAS in order to implement a SSO for a web site that it grouped some applications in different languages(Java, PHP). The servlet that I have created authenticate the user and to couple a cookie to session HTTP. The question is this:
The adopted solution is correct (work with the cookie)? going encounter to the problems of compatibility between various browser and the various applications, or it is better to maintain an "application" session on the server so that every application can demand it if the user is qualified to execute the operation demanded? even only maintaining a id in session HTTP? Thanks. Danilo

[Nicholas Cheung]

You need to maintain a list of each cookie together with the session id. For each request, when the cookie is being used, you may need to check whether this is a match.
Nick

[Gadzirai Moyo]

Use server side application session,for portability.

[Danilo Del Fio]

Yes, Gadzirai, I think that is the better choose.
Thank a lot.