OXSessionLifecycle

Lifecycle of an OX Session

This page describes in detail how a session is created, the components of a session and how they work together and which stages a session goes through during its existence.

Creating a session

Creating a session is a very straight forward process. Let's fire up a network sniffer and see what's exchanged between client and server during login (redacted for brevity, some of the stuff that's sent back and forth is not really relevant to our discussion):

POST /ajax/login?action=login&modules=true&client=com.openexchange.ox.gui.dhtml&version=6.20.0%20Rev7&authId=eedc7ddf-8c4b-4ba4-b00d-88250574eee1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Content-Type: application/x-www-form-urlenpred; charset=UTF-8

name=username%40contextname&password=somePassword

Let's go through this one thing at a time. Look at the first line:

POST /ajax/login?action=login&modules=true&client=com.openexchange.ox.gui.dhtml&version=6.20.0%20Rev7&authId=eedc7ddf-8c4b-4ba4-b00d-88250574eee1 HTTP/1.1

It's an HTTP POST that wants to do a login ( /ajax/login?action=login ).

POST /ajax/login?action=login&modules=true&'''client=com.openexchange.ox.gui.dhtml'''&version=6.20.0%20Rev7&authId=eedc7ddf-8c4b-4ba4-b00d-88250574eee1 HTTP/1.1

The first thing we have to look at is the client identifier (&client=...). The client identifier is com.openexchange.ox.gui.dhtml. The client identifier is used to differentiate between different client programs that use the same cookie store. For example one session in your browser is opened by the OX frontend and another one by a browser plugin. In order for the cookies used in session handling not overwriting each other, each client program provides its own client identifier, that is later used to construct the cookie names by way of the Cookie Hash.

POST /ajax/login?action=login&modules=true&client=com.openexchange.ox.gui.dhtml&version=6.20.0%20Rev7&'''authId=eedc7ddf-8c4b-4ba4-b00d-88250574eee1''' HTTP/1.1

The second thing that jumps out is the Auth-ID and the Auth-ID that will show up in log files is eedc7ddf-8c4b-4ba4-b00d-88250574eee1. Whenever you have to track a login or logout request among different systems of your apache / OX server cluster, for example, the Auth-ID will come in handy. It's a unique String that shows up on the requests way through the systems.

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

The User-Agent header is also used in constructing the cookie names used, or more precisely the Cookie Hash.

name=username%40contextname&password=somePassword

This line contains the parameters sent in the POST request. "name" is set to username@contextname, and the password is set to "somePassword". This information will be used by the authentication system to authenticate the user or deny the login request. Let's say everything goes right with our login attempts and look at the servers answer, again redacted for brevity and relevance to our discussion:

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Set-Cookie: open-xchange-secret-2H65ETpH7sX1kOWi6eyw=d4da87aaddf04ae8a1194715b08eede6; expires=Tue, 24-May-2011 13:28:59 GMT; path=/
Transfer-Encoding: chunked

90e
{"session":"4bb7202edae54094855b5a545d7123c3","random":"fd367d5c15ca4914b280982422008c4d","modules": '''/* SOME STUFF */'''  }
0

The answer provides the client with the two parts it later needs to construct valid requests: The Session Secret and the Session ID. As you can see in this line, the session secret is transferred as a cookie:

Set-Cookie: open-xchange-secret-2H65ETpH7sX1kOWi6eyw=d4da87aaddf04ae8a1194715b08eede6; expires=Tue, 24-May-2011 13:28:59 GMT; path=/

Notice the name of the cookie, which always starts with open-xchange-secret- followed by the cookie hash that is normally calculated from the User-Agent header of the login request, and the value of the client parameter. The expiry time of the cookie is goverened by the cookie lifetime configuration parameter and whether autologin is permitted or not. As I tried this request on Tue, 17-May-2011, the cookie will live one week.

The Session ID is transmitted to the client in the response:

{'''"session":"4bb7202edae54094855b5a545d7123c3"''',"random":"fd367d5c15ca4914b280982422008c4d","modules": /* SOME STUFF */ }

This session id will later be sent to the server in all requests as the session parameter.