Authentication: cookies, and sessions. please help

ddumont

Can someone explain what the Vanilla-Volatile cookie is for?

Also, is there a way with Vanilla 2+ to include the Garden session classes so that I can check for valid sessions and stuff from php files not served up by garden?

Alternatively, is there a way to make a plugin/page in garden not print out any garden markup? I'm interested in using garden for access control, authentication, and session checking but I don't want it to format anything (data call).

ddumont

@Lincoln @Todd
Can you comment at all on any of this?

Linc

I'm fairly certain Vanilla does auth via the cookie on every page, not by storing it in the session. You'll want to auth the cookie using the cookie hash in your config.php file.

There are several response types available in Garden. I assume you're looking for DeliveryMethod=JSON or something similar in your post calls.

ddumont

[removed... I'll discuss the exploit in PMs or email]

Linc

Wow... that's an embarassing security hole... this is ddumont btw

Linc

haha holy shit...

ddumont

Well I guess I answered my own question about the security... I hope @Todd and @Mark will look at this.

Todd

I think Vanilla-Volatile is there so that we can keep you signed in, but still increment your visit counts.

It's probably a little difficult to pull the files our necessary to grab the hash. It looks like you might be able to do the following:

1. Include class.cookieidentity.php.
2. Generate stubs for Gdn::Config() and ArrayValue(). We should actually switch Gdn::Config() to calls to C().

You can easily not have any Garden markup. Just create a controller and echo stuff right in the method. If you want to use a view then set the master page to "none." That master page is in the dashboard application.