session id cookie in gwt rpc

Question

Assuming I'm rolling my own session code, what's the right way to generate a unique and secure session id cookie in java.

Should I not be rolling my own but using something that's already been standardized?

I'm using gwt and the google app-engine platform.

How do I make sessions persist across browser/server restarts?

Solution 1

Using Servlet Sessions in GWT

In the remote service implementation class:

String jSessionId=this.getThreadLocalRequest().getSession().getId();

In the client code:

String jSessionId=Cookies.getCookie("JSESSIONID");

Enabling_Sessions

appengine-web.xml

<sessions-enabled>true</sessions-enabled>

Solution 2

No, you shouldn't be rolling your own.

The session ID needs to be cryptographically random (not guessable from known sources). It's difficult to get this right yourself.

Solution 3

Ideally you should be relying on the underlying framework's session management features. Servlets & JSPs, Struts and Spring have this support, which you should use.

In the extremely rare case that you are writing your own framework with no underlying session management features to rely on, you could start with the java.security.SecureRandom class to begin with. Of course, don't reinvent the wheel here, for broken session management is the same as broken authentication.

Update

Given that you are using Google App Engine, you should rely on the session management features provided by the engine. It seems that it is not switched on by default.

Comments

[Vineet Reynolds]

By the way, Axis 1.x does implement session management using the SecureRandom class. I'm not sure on why they chose it, but this is the only one-off case that I have encountered.

[Vineet Reynolds]

More details on the Axis 1.x session management design can be found at wiki.apache.org/ws/FrontPage/Axis/SessionSupport. The supposed reason (that I could think of) for not using HttpSession is to support sessions across different protocols.