1. How to maintain state in a stateless web Shirley Cohen scohen@tacc.utexas.edu

2. What is meant by state? To maintain state means the ability to retain values of variables and to keep track of users who are logged into the system.

3. Methods for maintaining state Cookies Sessions Passing [hidden] variables

4. What is a cookie? Cookies are simple text strings of the form of name=value which are stored persistently on the client’s machine. A URL is stored with each cookie and it is used by the browser to determine whether it should send the cookie to the web server.

5. Cookie Example <?php $count++; setCookie(“count”, $count); ?> Welcome! You’ve seen this site

6. Common Pitfalls Can’t call setCookie() after output has been sent to the browser Can’t have more than 20 cookies/server Cookies ONLY persist until the browser closes UNLESS you specify an expiry date: set Cookie(“name”, $value, time() + 3600);

7. Sessions Sessions are just like cookies, except they store the user’s data on the web server. Every request has a unique session id. Sessions are said to be 30% more reliable than cookies.

8. Session Example ?php // start the session session_start(); print " Step 2 - Register Session "; // Get the user's input from the form $name = $_POST['name']; // Register session key with the value $_SESSION['name'] = $name; // Display the session information: ?> Welcome to my website ! Let's see what happens on the next page.

9. Destroying a Session <?php // start the session session_start(); $_SESSION = array(); session_destroy(); print " Step 5 - Destroy This Session "; if($_SESSION['name']) { print "The session is still active"; } else { echo "Ok, the session is no longer active! "; } ?>

10. Session Tutorial Site http://www.phpfreaks.com/tutorials/41/0.php

11. Passing Variables

12. EID Topic EID module authenticates a user using a valid EID and password which are sent to the UT directory server using SSL. The UT directory server returns a cookie to the requestor and the requestor can then retrieve the relevant information about the user.

13. Web Central Users Use an.htaccess file on the directory they want to protect: Examples:. htaccess file to allow access for any valid UT EID SSLRequireSSL AuthType Anything AuthName Anything EID_Required on require valid-eid.htaccess file to allow restricted access for a small group SSLRequireSSL AuthType Anything AuthName Anything EID_Required on require eid UniqueID1 UniqueID2

14. Web Central EID Tutorial http://www.utexas.edu/learn/restrict/index.html

15. Non-Web Central Users PHP EID Module: David Cook (not stable at the moment) ColdFusion EID Module: Lisa Barden (now stable according to Eng.) Request ITS authorization from: James M Ferrero

16. Questions ???