Saving a session after refreshing a page using server-side rendering using response.js

Question

Although not entirely accurate if this is a specific specific question:

We develop and apply applications using a response / reduction package with server-side processing. After the user logs in, we get two cookies for identification and one for a session in the browser (with an expiration date). The problem is that the user refreshes the page in which the state gets reset, and we lose session information (we basically set some variables in the state to indicate that the user is logged in).

The question is how to manage this situation and maintain user registration, even when the page refreshes. I’m thinking about completely deleting the image on the server side and just checking the expired session cookie on the client side when the page is initially displayed, and setting some variables in the state if the session is still alive, and vice versa - the version otherwise .

Does this sound like a safe approach? Is there a better way to do this?

Answer 1

I had a similar problem. I don't see anything bad in person, checking cookies and rewriting to a UI session, if possible. The server is still protected by the correct cookies.

In my case, however, I was not able to verify cookies through JS, as they were set as http-only . In the end, I had to go for the following solution:

---

When a user logs in for the first time, successfully create an instance of sessionStorage to indicate that there is an active session:

 window.sessionStorage.setItem(sessionKey, stringifiedUserToken); 

If the page refreshes, check this session item and re-register the active session:

 const activeSession = window.sessionStorage.getItem(sessionKey); if (activeSession) { // fire register user session action } 

If the user logs out, destroy the storage token.

---

All interaction with the server still requires a cookie to be transmitted together, so this is an exclusively interface problem.

Session storage will be emptied at the end of the browser session, so this naive approach may not work for “persistent” sessions. It has really great browser support: http://caniuse.com/#search=sessionStorage