Session Management and Mega-Proxies?

chicagothad asks: "I help to run large internet systems for a few Fortune 500 companies. We are running several clustered systems, comprised of both Microsoft and Linux technologies. We have run into several problems with what is known as a 'mega-proxy'. A mega proxy is a way that large internet providers distribute their outbound traffic via a pool of IPs. AOL/Compuserve is the largest example of this. We are having fits with session management right now. Does anyone have any ideas on the best system structure or design to manage these beasts or any other tips that may be helpful?"

Comments

there are a few ways to do this

[Phork]

using a client IP as a session key is a horrible way to do session managment, very bad idea. generate a random(but unique) key to use, try to set it as a cookie, if that fails, append it to the url. if that fails, you have a few options, have a failsafe version of the site that works without session managment, or you can present the user an error message, or you can fall back to using the ip, the most common choice seems to be to present an error message saying something to the ffect of "for this site to work properly you must enable cookies in your web browser. this can be done by doing xyz in your browser.

Most web app enviroments provide this functionality either built in, or through a library, php and perl both do, and im fairly sure IIS/asp does.

this is one of those problems that has been solved a thousand times before, and chances are, someone else has done a better job of solving it than you will on your first try.

Re:there are a few ways to do this

[Wolfkin]

[...]if that fails, append it to the url. if that fails, you have a few options[...]

How, exactly, could appending it to the URL fail? I use this method in everything I do that requires session ids (since it avoids the extra code for cookie checking, and you can hide the ugly session URL behind frames), and haven't ever had it fail. I'm not sure how that would even be possible.

Re:URLs

[SuiteSisterMary]

Still need to make abso-ma-loutely sure that session keys'll never ever be recycled. Also, make sure you don't store session keys, dates, stuff like that 'raw.' Either you or your server software should do fun things like hash them, so you can tell accidental or purposeful tampering.

How'd you get the job?

[The AtomicPunk]

Without knowing something so basic to web site operation?

I hate the nature of this AskSlashdot item

[billcopc]

Why should we (the intelligent users) tell you (the overpaid 'consultant') how to put together a good session-based system ? The information is readily available on the web for anyone to read, and it's not even that hard to find, assuming you know how to use a search engine such as Google. The solution is a hybrid of simple techniques which make up for each others' weaknesses. Just use that Fortune-500 brain you've been neglecting all these years.