CODEWITHSUNDEEP
imagecookiessession-cookiesphp
dannymcc
dannymcc

Reputation: 3814

Prevent a session from expiring?

We have a simple CCTV system in our office that shows a live image from each of our security cameras. The CCTV system doesn't have an API or any method of extracting the live images. You can however view the image from another browser by creating a basic HTML page with the image link:

http://192.168.1.6/media/getimage_sid.php?sid=a09c4ecb72bade3802e7bf563b0d0bd6&card=1&camera=1&width=384&height=288

This works perfectly, until the session expires and/or timesout. I don't know very much about cookies and sessions but when I inspected the page in Google Chrome I noticed the following cookie:

Name       Value                             Domain       Path   Expires   Size
PHPSESSID  a09c4ecb72bade3802e7bf563b0d0bd6  192.168.1.6  /      Session   41

there is also a HTTP column and a Secure column but both are empty.

What I am trying to figure out, is how do I keep that cookie alive or trigger it to recreate with the same value? I'm assuming that a rake task to log in to the system wouldn't work because that would reset the session ID every time.

The intranet is a Rails application, so one way would be to create a script that logs in and stores the current session ID to the database and then putting the last recorded sessions ID into the IMG links from the database. It's a bit of a long way around though, I'm hoping for a better solution.

I have read a few articles showing how to do this with AJAX but that would appear to rely on the intranet being viewed all the time. I need this to work if no-one has viewed the intranet for the weekend.

This project is so we can put a couple of live (when the page refreshes!) images on our intranet so we don't have to continuously go to the CCTV system, log in and find the right camera just to see who is at the garage door etc.

Any help would be appreciated.

Upvotes: 2

Views: 403

Answers (3)

Yuval
Yuval

Reputation: 3433

The session ID used in the cookie seems to be the PHP generated one.

I don't think session ID should become stale if you 'notify' the server that you're still online.1 You should try to specify the Cookie: in your HTTP request headers. Specifying the SID via the URL is probably not be enough to indicate to the server that you're actually using it.2

If your web-pages are fetching the images directly (i.e. you have an <img src="http://192.168.1.6/..."> in the HTML page) you might work like this:

  • make an AJAX request (XMLHttpRequest) to a URL which returns a session ID.
  • any subsequent request to the server on that page should automatically include the session in the headers.3

Otherwise, if you can't specify a Cookie: header, you may choose to make the time before a session becomes stale longer. If you have access to the computer hosting the PHP interface (192.168.1.6) then you can configure PHP to do so (via the php.ini configuration file, I believe). Information about session configuration is available here, and specifically the gc-maxlifetime options seems useful:

session.gc_maxlifetime specifies the number of seconds after which data will be seen as 'garbage' and potentially cleaned up. Garbage collection may occur during session start (depending on session.gc_probability and session.gc_divisor).

Alternatively, if none of the above appeal to you, your solution to fetch (GET) a page to obtain a valid, fresh session ID seems logical and good. You could optimize this by measuring how long it takes before session IDs become stale and fetching new session IDs only at that interval.

1 I looked for a valid reference for this but couldn't find one.

2 specifically PHP uses a PHPSESSID= token in the URL whereas in your example it looks like sid=. It is also generally considered bad practice security-wise I believe (this article explains how it might be used for XSS), since you're exposing user information in the URL, though I think this has little to no effect in this case

3 according to the XMLHttpRequest spec of the send() method:

If the user agent supports HTTP State Management it should persist, discard and send cookies

Upvotes: 0

Stobor
Stobor

Reputation: 45122

A random different approach: does the following URL get the right image, without having to worry about the session id?

 http://192.168.1.6/media/getimage_sid.php?card=1&camera=1&width=384&height=288

Upvotes: 0

dannymcc
dannymcc

Reputation: 3814

It's a bit of hack but I've made a small script to pull in the latest session ID and then put it into the image links.

Upvotes: 3

Related Questions