Mailing-List: contact modperl-help@perl.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: neutral (athena.apache.org: local policy)
To: bvs7085@gmail.com
Cc: Michael Peters <mpeters@plusthree.com>, Mod_Perl <modperl@perl.apache.org>
Subject: Re: Ways to scale a mod_perl site
References: <e86b7d350909160849vb4a9c5dt3b8793d187521ddd@mail.gmail.com>
	<4AB10CB8.7010202@plusthree.com> <4AB10EA2.70108@gmail.com>
From: Scott Gifford <sgifford@suspectclass.com>
Date: Fri, 18 Sep 2009 11:52:57 -0400
In-Reply-To: <4AB10EA2.70108@gmail.com> (Brad Van Sickle's message of "Wed,
 16 Sep 2009 12:13:22 -0400")
Message-ID: <lyeiq445d2.fsf@gfn.org>
User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii

Brad Van Sickle <bvansickle3@gmail.com> writes:

>>
>>> 3) Being enabled by item 2, add more webservers and balancers
>>> 4) Create a separate database for cookie data (Apache::Session objects)
>>> ??? -- not sure if good idea --
>>
>> I've never seen the need to do that. In fact, I would suggest you
>> drop sessions altogether if you can. If you need any per-session
>> information then put it in a cookie. If you need this information to
>> be tamper-proof then you can create a hash of the cookie's data that
>> you store as part of the cookie. If you can reduce the # of times
>> that each request needs to actually hit the database you'll have big
>> wins.
>>
>>
>
> Can I get you to explain this a little more?  I don't see how this
> could be used for truly secure sites because I don't quite understand
> how storing a hash in a plain text cookie would be secure.

The general idea is that you store a cryptographic hash of the cookie
information plus a secret only your app knows.  Using | to show string
contatenation, your cookie would be:

    YourCookieFields|HASH(YourCookieFields|YourSecret)

An attacker can't create the right hash because they don't know your
secret, and they can't change any fields in the cookie because the
hash would become invalid.

-----Scott.