Soma at 18:18, 15 February 2013

2013-02-15T18:18:42Z

← Older revision		Revision as of 18:18, 15 February 2013
Line 14:		Line 14:
	* /update: update personal information (POST for /info form)		* /update: update personal information (POST for /info form)

	Logout should take you back to the login screen or a custom "you've logged out, click here to login again" screen.		The "invisible" toggle should control whether the user shows in the list of logged in users. Logout should take you back to the login screen or a custom "you've logged out, click here to login again" screen.

	How hard is it to keep per-user information separate?		While implementing this, consider:
			* How hard is it to keep per-user information separate?
			* What is the secret used to initialize the cookie? Why is it needed?
			* What do the session cookies look like?
			* What part of the app sets the cookie? Retrieves it?
			* Where should you store per-user information persistently (at least, for as long as the web server is running)?

	Good luck!		Good luck!

Soma: Created page with "In this tutorial we'll examine a simple express demo that lets you set a session by "logging in". Note that there is NO SECURITY in this example. We will cover that later! ..."

2013-02-15T18:06:03Z

Created page with "In this tutorial we'll examine a simple express demo that lets you set a session by "logging in". Note that there is NO SECURITY in this example. We will cover that later! ..."

New page

In this tutorial we'll examine a simple express demo that lets you set a session by "logging in". Note that there is NO SECURITY in this example. We will cover that later!

First, download and look at [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-session-auth.zip demo-session-auth]. After running "npm install" in the directory, you should be able to run "node app.js".

(If you need to get node running on Windows computers where you don't have admin access, see [[WebFund_2013W:_Express_and_AJAX|the last tutorial]].)

You'll notice this app allows you to login, and then once you are logged in you stay logged in until you log out. Your login state is stored in a cookie managed by express. Specifically, notice how this code makes use of the [http://www.senchalabs.org/connect/session.html session] functionality of [http://www.senchalabs.org/connect/ connect].

To test your understanding, modify this application so that when you login, you get a list of logged in users. With each user is associated personal information that can be updated by just that user. Specifically, implement the following

* /: Login screen if you aren't logged in
* /: List of logged in users, if logged in
* /info: information on the logged in user in editable fields (name, address, email, invisible)
* /update: update personal information (POST for /info form)

Logout should take you back to the login screen or a custom "you've logged out, click here to login again" screen.

How hard is it to keep per-user information separate?

Good luck!

WebFund 2013W: Sessions - Revision history

Soma at 18:18, 15 February 2013

Soma: Created page with "In this tutorial we'll examine a simple express demo that lets you set a session by "logging in". Note that there is NO SECURITY in this example. We will cover that later! ..."