Timeline for Storing encryption key in a cookie?
Current License: CC BY-SA 3.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 24, 2020 at 23:23 | vote | accept | Bob.at.Indigo.Health | ||
| May 31, 2015 at 16:41 | history | edited | Bob.at.Indigo.Health | CC BY-SA 3.0 |
Added further analysis ("EDIT #1")
|
| May 30, 2015 at 16:33 | comment | added | Bob.at.Indigo.Health | @ParthShah The second option. Other than the encrypted answers that are the subject of this inquiry, I don't store any patient data in the database. All patient answers are stored in InProc session state. When an interview is completed (or 7 days after the interview started, whichever comes first), the encrypted "answers" blob is deleted from the database (insofar as anything can truly be deleted from a SQL Server database). | |
| May 29, 2015 at 2:46 | answer | added | Parth Shah | timeline score: 0 | |
| May 29, 2015 at 0:14 | comment | added | Parth Shah | @Bob.at.SBS where and how do you store responses of completed interviews? Or do you just make a report immediately after it is completed, send it to your customer and delete data off your database? | |
| May 28, 2015 at 16:56 | comment | added | Bob.at.Indigo.Health | @ParthShah No, I need to provide as pleasant and functional an experience as I can to the user regardless of their browser. In particular, I can't assume they support HTML5 beyond whatever magic modernizr gets me. | |
| May 27, 2015 at 4:00 | comment | added | Parth Shah | Can you make any assumption on the modern-ness of the browsers the users will be using to complete the interviews? For example can you assume the users' browsers do support HTML5? | |
| Apr 27, 2015 at 4:11 | comment | added | Bob.at.Indigo.Health | Actually, I'm doing that as well. But this will fail to keep the session alive if the user walks away long enough for the PC to go to sleep, or if JS isn't enabled. The cookie hack should allow the user to actually close the browser. When the user tries to (re)start the interview, I can detect the cookie and offer to resume the interview. | |
| Apr 27, 2015 at 2:46 | comment | added | AKS | Is running a silent background Ajax request violating any security practice? This way, you can keep the session alive until the user takes his 90 minutes. | |
| Apr 27, 2015 at 2:08 | answer | added | Alex Lauerman | timeline score: 1 | |
| Apr 26, 2015 at 23:34 | review | First posts | |||
| Apr 26, 2015 at 23:55 | |||||
| Apr 26, 2015 at 23:32 | history | asked | Bob.at.Indigo.Health | CC BY-SA 3.0 |