COOKIE BASED SESSION MANAGEMENT

• US 20150088978A1
• Filed: 09/19/2014
• Published: 03/26/2015
• Est. Priority Date: 09/20/2013
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Motukuru, Vamsi, Chathoth, Vikas Pooven, Koottayi, Vipin Anaparakkal
• Granted Patent: US 9,866,640 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/148 Migration or transfer of sessions

Abstract

An enterprise software system access manager saves cookies for users'"'"' sessions on client devices but creates server-side sessions on the fly when needed for the users to access certain features, when there is a constraint on the client device, or due to application policies. The server-side session objects can have references to the client-side cookies and can have key-value pairs added to them instead of the associated cookie.

Claims

1. A method for managing user sessions in an enterprise environment, the method comprising:

generating, with one or more computer systems, a session cookie maintaining data related to a session of a client device in an enterprise environment;

sending the session cookie to the client device instructing the client device to store the session cookie;

receiving, at the one or more computer systems, a request from a user to access a feature of an application on the enterprise environment;

determining, with one or more processors associated with the one or more computer systems, whether the feature requires a server-side session;

instantiating, with the one or more processors associated with the one or more computer systems, a server-side session object for the user in response to the request when the feature requires a server side session;

updating, with the one or more processors associated with the one or more computer systems, the server-side session object with a reference to the session cookie on the client device;

generating with the one or more processors associated with the one or more computer systems, a response to the request based on accessing the feature using the server-side session object; and

sending the response to the client device.

2. The method of claim 1 wherein determining, with the one or more processors associated with the one or more computer systems, whether the feature requires a server-side session comprises determining whether an administrator-configurable policy is applicable to the feature.

3. The method of claim 2 wherein the policy includes a security policy.

4. The method of claim 2 wherein the policy includes a resource usage policy.

5. The method of claim 1 wherein determining, with the one or more processors associated with the one or more computer systems, whether the feature requires a server-side session comprises determining that the feature demands a limit on a number of concurrent users.

6. The method of claim 1 wherein determining, with the one or more processors associated with the one or more computer systems, whether the feature requires a server-side session comprises determining that the feature demands a time limit on a user session.

7. The method of claim 1 wherein determining, with the one or more processors associated with the one or more computer systems, whether the feature requires a server-side session comprises determining that the feature demands a large amount of data to be stored in the session and the client device is memory limited.

8. The method of claim 1 wherein further comprising:

updating, with the one or more processors associated with the one or more computer systems, the server-side session object with state information pertaining to the feature.

9. A non-transitory computer-readable medium storing a computer program product which when executed by a processor of a computer system cause the processor to:

generate a session cookie maintaining data related to a session of a client device in an enterprise environment;

send the session cookie to the client device instructing the client device to store the session cookie;

receive a request from a user to access a feature of an application on the enterprise environment;

determine whether the feature requires a server-side session;

instantiate a server-side session object for the user in response to the request when the feature requires a server side session;

update the server-side session object with a reference to the session cookie on the client device;

generate a response to the request based on accessing the feature using the server-side session object; and

send the response to the client device.

10. The non-transitory computer-readable medium of claim 9 wherein to determine whether the feature requires a server-side session the computer program product causes the processor to determine whether an administrator-configurable policy is applicable to the feature.

11. The non-transitory computer-readable medium of claim 10 wherein the policy includes a security policy.

12. The non-transitory computer-readable medium of claim 10 wherein the policy includes a resource usage policy.

13. The non-transitory computer-readable medium of claim 9 wherein to determine whether the feature requires a server-side session the computer program product causes the processor to determine that the feature demands a limit on a number of concurrent users.

14. The non-transitory computer-readable medium of claim 9 wherein to determine whether the feature requires a server-side session the computer program product causes the processor to determine that the feature demands a time limit on a user session.

15. The non-transitory computer-readable medium of claim 9 wherein to determine whether the feature requires a server-side session the computer program product causes the processor to determine that the feature demands a large amount of data to be stored in the session and the client device is memory limited.

16. The non-transitory computer-readable medium of claim 9 wherein the computer program product further causes the processor to:

update the server-side session object with state information pertaining to the feature.

17. A system comprising:

a hardware processor; and

a memory storing a set of instructions which when executed by the processor cause the processor to;

generate a session cookie maintaining data related to a session of a client device in an enterprise environment;

send the session cookie to the client device instructing the client device to store the session cookie;

receive a request from a user to access a feature of an application on the enterprise environment;

determine whether the feature requires a server-side session;

instantiate a server-side session object for the user in response to the request when the feature requires a server side session;

update the server-side session object with a reference to the session cookie on the client device;

generate a response to the request based on accessing the feature using the server-side session object; and

send the response to the client device.