I am working on a large web application that runs entirely within a single web-page. For various reasons we do not want to use cookies in this web application, at all, but we need to keep track of whether a user is currently logged in or not. All of our connections are over SSL. Here is how we plan to keep track of sessions:
With each response sent by the server, it sends an session token.
The session token is an encrypted string containing the following:
- The UserID
- A SessionID
- A salt (randomly generated each time)
- A current time-stamp
- An expire time-stamp, exactly half an hour after the current time-stamp
When the client sends a request, it must also send this session token. The token is decrypted and the time-stamps are checked to see if they are half an hour apart, and that the present time is between the two time-stamps. If so, the request is processed, using the user ID to identify who made the request. If not, the request is not processed, and a response telling the client to log the user out is sent.
Will this system leave us horribly vulnerable to people falsely identifying as a user? Do you see any other problems with this?