Sessões web
The 4D web server provides built-in features for managing web sessions. Creating and maintaining web sessions allows you to control and improve the user experience on your web application. When web sessions are enabled, web clients can reuse the same server context from one request to another.
As sessões Web permitem:
- handle multiple requests simultaneously from the same web client through an unlimited number of preemptive processes (web sessions are scalable),
- manage session through a
Session
object and the Session API, - store and share data between processes of a web client using the .storage of the session,
- associate privileges to the user running the session.
Usos
As sessões Web são usadas para:
- Aplicaciones web que envían peticiones http,
- calls to the REST API, which are used by remote datastores and Qodly forms.
Activando sessões web
The session management feature can be enabled and disabled on your 4D web server. Existem diferentes formas de ativar a gestão de sessões:
- Using the Scalable sessions option on the "Web/Options (I)" page of the Settings (permanent setting):
Esta opção é selecionada por defeito nos novos projetos. Sin embargo, se puede desactivar seleccionando la opción Sin sesiones, en cuyo caso las funcionalidades de la sesión web se desactivan (no hay ningún objeto Session
disponible).
- Using the
.scalableSession
property of the Web Server object (to pass in the settings parameter of the.start()
function). In this case, this setting overrides the option defined in the Settings dialog box for the Web Server object (it is not stored on disk).
El comando
WEB SET OPTION
también puede establecer el modo de sesión para el servidor web principal.
In any cases, the setting is local to the machine; so it can be different on the 4D Server Web server and the Web servers of remote 4D machines.
Compatibilidad: una opción Sesiones legacy está disponible en proyectos creados con una versión de 4D anterior a 4D v18 R6 (para más información, consulte el sitio web doc.4d.com).
Session implementation
Cuando se habilitan las sesiones, se implementan mecanismos automáticos, basados en una cookie privada establecida por el propio 4D: "4DSID__AppName_", donde AppName es el nombre del proyecto de la aplicación. Este cookie faz referência à sessão web atual da aplicação.
The cookie name can be get using the .sessionCookieName
property.
-
En cada petición del cliente web, el servidor web comprueba la presencia y el valor de la cookie privada "4DSID__AppName_".
-
If the cookie has a value, 4D looks for the session that created this cookie among the existing sessions; if this session is found, it is reused for the call.
-
Se a solicitação do cliente não corresponder a uma sessão já aberta:
- se crea una nueva sesión con una cookie privada "4DSID__AppName_" en el servidor web
- se crea un nuevo objeto Guest
Session
dedicado a la sesión web escalable.
La creación de una sesión web para una petición REST puede requerir que una licencia esté disponible, consulte esta página.
The Session
object of the current session can then be accessed through the Session
command in the code of any web processes.
Os processos Web geralmente não terminam, eles são reciclados em um pool para aumentar a eficiência. When a process finishes executing a request, it is put back in the pool and made available for the next request. Since a web process can be reused by any session, process variables must be cleared by your code at the end of its execution (using CLEAR VARIABLE
for example). This cleanup is necessary for any process related information, such as a reference to an opened file. Esta es la razón por la que se recomienda utilizar el objeto Sesión cuando se quiera guardar información relacionada con la sesión.
Armazenar e compartilhar informações de sessão
Each Session
object provides a .storage
property which is a shared object. This property allows you to share information between all processes handled by the session.
Duração da sessão
Uma sessão Web escalável é encerrada quando:
- o servidor web está parado,
- o tempo limite do cookie de sessão foi atingido.
The lifespan of an inactive cookie is 60 minutes by default, which means that the web server will automatically close inactive sessions after 60 minutes.
This timeout can be set using the .idleTimeout
property of the Session
object (the timeout cannot be less than 60 minutes) or the connectionInfo parameter of the Open datastore
command.
When a web session is closed, if the Session
command is called afterwards:
- el objeto
Session
no contiene privilegios (es una sesión de invitado) - the
.storage
property is empty - um novo cookie de sessão é associado à sessão
You can close a session from a Qodly form using the logout feature.
Privilégios
Privileges can be associated to web user sessions. On the web server, you can provide specific access or features depending on the privileges of the session.
You assign privileges using the .setPrivileges()
function. In your code, you can check the session's privileges to allow or deny access using the .hasPrivilege()
function. By default, new sessions do not have any privilege: they are Guest sessions (.isGuest()
function returns true).
Exemplo:
If (Session.hasPrivilege("WebAdmin"))
//Access is granted, do nothing
Else
//Display an authentication page
End if
Privileges are implemented at the heart of the ORDA architecture to provide developers with a powerful technology for controlling access to the datastore and dataclas functions. For more information, please refer to the Privileges page of the ORDA chapter.
Exemplo
Em uma aplicação CRM, cada vendedor gerencia seu próprio portefólio de clientes. The datastore contains at least two linked dataclasses: Customers and SalesPersons (a salesperson has several customers).
We want a salesperson to authenticate, open a session on the web server, and have the top 3 customers be loaded in the session.
- Executamos este URL para abrir uma sessão:
http://localhost:8044/authenticate.shtml
En un entorno de producción, es necesario utilizar una conexión HTTPS para evitar que cualquier información no cifrada circule por la red.
- La página
authenticate.shtml
es un formulario que contiene los campos de entrada userId y password y envía una acción 4DACTION POST:
<!DOCTYPE html>
<html>
<body bgcolor="#ffffff">
<FORM ACTION="/4DACTION/authenticate" METHOD=POST>
UserId: <INPUT TYPE=TEXT NAME=userId VALUE=""><br/>
Password: <INPUT TYPE=TEXT NAME=password VALUE=""><br/>
<INPUT TYPE=SUBMIT NAME=OK VALUE="Log In">
</FORM>
</body>
</html>
- El método authenticate project busca la persona userID y valida la contraseña contra el valor hash ya almacenado en la tabla SalesPersons:
var $indexUserId; $indexPassword; $userId : Integer
var $password : Text
var $userTop3; $sales; $info : Object
ARRAY TEXT($anames; 0)
ARRAY TEXT($avalues; 0)
WEB GET VARIABLES($anames; $avalues)
$indexUserId:=Find in array($anames; "userId")
$userId:=Num($avalues{$indexUserId})
$indexPassword:=Find in array($anames; "password")
$password:=$avalues{$indexPassword}
$sales:=ds.SalesPersons.query("userId = :1"; $userId).first()
If ($sales#Null)
If (Verify password hash($password; $sales.password))
$info:=New object()
$info.userName:=$sales.firstname+" "+$sales.lastname
Session.setPrivileges($info)
Use (Session.storage)
If (Session.storage.myTop3=Null)
$userTop3:=$sales.customers.orderBy("totalPurchase desc").slice(0; 3)
Session.storage.myTop3:=$userTop3
End if
End use
WEB SEND HTTP REDIRECT("/authenticationOK.shtml")
Else
WEB SEND TEXT("This password is wrong")
End if
Else
WEB SEND TEXT("This userId is unknown")
End if