Re:A practical proposal for migrating to safe long sessions ...
by ploxiln on Friday July 22, 2016 @04:03AM
(#12142307)
You can re-verify on the backend however often you like.
Make the signed cookie include user-id and date (and maybe a session id). Accept it without backend-check while it's less than X minutes old. Buf if it's older than that, check the backend to see if the user has invalidated sessions since it was generated. In the typical all-good case, generate a new signed cookie and put it in the response. No need for service workers or anything.
A web company I worked for a couple years ago implemented something almost exactly like this while I was there.
Make the signed cookie include user-id and date (and maybe a session id). Accept it without backend-check while it's less than X minutes old. Buf if it's older than that, check the backend to see if the user has invalidated sessions since it was generated. In the typical all-good case, generate a new signed cookie and put it in the response. No need for service workers or anything.
A web company I worked for a couple years ago implemented something almost exactly like this while I was there.