1

For performance reasons I'm setting some user info in the local storage of the client/navigator when he logs in.

It allows me to tune the pages appearance (show/hide menus, display the name of the user,etc...) whether the user is logged or not.

This works perfectly as long as there is no session desynchronization between the client and the server. For instance if the server session ids are flushed, the client has no way to guess it. As a consequence, the user cannot access the "private" content (redirection to the home page in my case) although the page appearance looks like the user is still connected/identified.

A first solution that came to me is to detect the redirection on the client side (javascript), erase the local information regarding the user and modify the website appearance to correspond to a disconnected user.

My question is

Is there another smarter way to detect session id invalidation from the client side?

Subsidiary question

Are there side effects I'm missing with the "page redirection" detection solution?

  • Rather than redirecting to the home page, couldn't you prompt the user to provide their log in credentials again? That is the way that Amazon handles I'm on their site. – Stephen Ostermiller Jan 11 '17 at 21:56
  • So if the server rejects the JSON when it is sent then ask the user for credentials again and then resend the json – Stephen Ostermiller Jan 14 '17 at 13:41
  • @StephenOstermiller: forget my message I went to fast. The server doesn't reject the JSON since it cannot identify the user. Bad user => no proper answer. Instead it redirects him to the home page. And I do not have credential page so I cannot redirect to this page instead. – Nitseg Jan 14 '17 at 13:50
  • So have the server respond with an error code instead of redirecting. Then your client code can handle it. – Stephen Ostermiller Jan 14 '17 at 13:52
  • @StephenOstermiller: exact. You are right. That is the solution I implemented. :-) – Nitseg Jan 14 '17 at 13:56
1

The solution I decided to go for:

Client: On redirection detection (3xx HTTP response) the client is sending a request to the server to check specifically if the user is connected or no (the redirection can be due to another reason than "unidentified" user).

Server: The server answers this request that is allowed for any user (identified or not) and hence not triggering a redirection.

Client: On answer reception the client decides to display the "identified" or "unidentified" interface of the page. If not identified it erases the user data from local storage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.