Grendel sessions

[precipice]

It would be good to be able to have a session handle that would allow access to Grendel without having to store the plaintext password during the session. For instance, let me create a session on user login, use that session during the user's session on the site, and destroy it when they log out.

[codahale]

Sam and I talked about this — we'd need to cache the UnlockedKeySet of the user in memory.

[stephanwehner]

I thought the way to handle this is to would store a key in the cookie, and the UnlockedKeySet, encrypted with that key on the server. Link the two with a database id (since more than one user will be logged in)

Something wrong with that ?

Stephan

[codahale]

Stephan — that's not at all different from how Grendel uses KeySet and the user's password.

[stephanwehner]

Then I guess I don't quite understand the original question.

Isn't the "key in the cookie" I mentioned going to be the "session handle" that precipice is asking about?

Stephan

[codahale]

No. It would be a random session ID. We already have this designed; this ticket is just a reminder for us to actually implement it.