Toru Yamaguchi gave a presentation on advanced cookie usage. He explained the differences between host cookies and domain cookies, and how the path attribute can be used to control where cookies are sent. He discussed how JSON web tokens (JWT) can be used for login sessions by embedding user agent information. Finally, he mentioned how transparent session state cookies allow for single logout between authorization servers and client applications.

1. How to bake
delicious cookie
ToruYamaguchi (@zigorou)
DeNA Co.,Ltd.
Mobage Platform Senior Architect
2014年4月14日月曜日

2. Self Introduction
• Platform Architect
• RESTful APIs, JSON-RPC APIs design and impl
• OpenSocial JavaScript API design
• Native SDK backend design
• Activity Streams backend design and impl
• Mobage Connect (OAuth 2.0 and OpenID Connect Server)
design
• JavaScript SDK design
• etc ...
• Perl Monger
• https://metacpan.org/author/ZIGOROU
• Profile
• @zigorou (twitter)
2014年4月14日月曜日

3. Recent implementation
• JSON Pointer (perl)
• JSON::Pointer
• JSON Schema validator (perl)
• JSV (not released to CPAN)
2014年4月14日月曜日

4. My recent interest
• Guessing the typical making of Web
Application
• Especially, STATEful web application's
session behavior
2014年4月14日月曜日

5. Cookie???
2014年4月14日月曜日

6. HTTP Cookie!
• Today, we learn detail of HTTP cookie
behavior
• And more, we learn advanced cookie usage
2014年4月14日月曜日

7. Host Cookie
• The host cookie is received by Set-Cookie
response header without domain attribute
• The host cookie is shared only the sender
domain
2014年4月14日月曜日

8. Domain Cookie
• The domain cookie is recieved by Set-
Cookie response header with domain
attribute
• The domain cookie is shared to sender
domain and sender sub-domains.
2014年4月14日月曜日

9. Host and Domain
Cookie Differences
sender
aaa.example.com bbb.example.com aaa.example.com bbb.example.com
sender
Host Cookie
Domain Cookie
Set-Cookie: foo=1;
Set-Cookie: foo=1;
domain=example.com
2014年4月14日月曜日

10. Typical usage of domain
cookie
• Sharing UserAgent STATE between many
web services have same domain suffix.
• login session
• tracking
2014年4月14日月曜日

11. The path attribute
• The path attribute controls Cookie sending
from UserAgent by URI path
• This feature is very interesting usage by
many services
• Especially Google+ SignIn
2014年4月14日月曜日

12. The path behavior
/foo
/foo/bar
/abc
/
Set-Cookie: xyz=1; path=/foo
2014年4月14日月曜日

13. Gmail multiple session
by path attribute
personal
work /mail/u/1
/mail/u/0
2014年4月14日月曜日

14. Transactional session
(1)
• Creating temporary transactional resource
• GET /resources/new
• 302 Found
• Location: /resources/{resId}
• Set-Cookie:TSID=xyz123; path=/
resources/{resId}
• Continue process until finishing transaction
2014年4月14日月曜日

15. Transactional Session
(2)
• The path attribute ensures sharding scope
of transactional session is only under the
transactional resource endpoint
• Managing STATE by URI !!!
• Secure
• Expiration friendly
2014年4月14日月曜日

16. JSON Web Token
• Do you know JWT?
• JWT is JSON Web Token
• JWT includes original JSON Object
• JWT has few registered claims (≒vocabulary)
• issuer, audience, subject
• issued at, expired at
• etc ...
• JWT supports signature (JWS) and encryptiong (JWE)
2014年4月14日月曜日

17. JWT encode/decode
#!/usr/bin/env
perl
use
strict;
use
warnings;
use
JSON::WebToken
qw(
encode_jwt
decode_jwt
);
my
$jwt
=
encode_jwt({
foo
=>
1
},
"secret");
my
$json
=
decode_jwt($jwt,
"secret");
2014年4月14日月曜日

18. Using JWT to login
session cookie (1)
• Expires time of JWT is server-side time
• But Cookie's expires time is client-side time
• And more, Server sometimes can confirm
expiration without lookup session db
• Verify UserAgent
• Embed UA hash value to JWT
• Verify session
• It is just verification of JWT signature.
2014年4月14日月曜日

19. Using JWT to login
session cookie (2)
my
$session_value
=
encode_jwt(decode_json(<<JSON
{
"jti":
"1234567",
"iss":
"https://authz.example.com",
"aud":
"https://authz.example.com",
"sub":
"https://profile.example.com/zigorou",
"https://schema.example.com/session":
{
"ua_hash":
331365789,
"remote_addr_ipv4_hash":
595682001,
"tracking_cookie_hash":
1361976131
},
"iat":
1397293921
"exp":
1397380321
}
JSON
),
"secret");
2014年4月14日月曜日

20. Transparent Session
State Cookie
• In OpenID Connect Session Management (http://
openid.net/specs/openid-connect-
session-1_0.html) specification
• Using cookie without HttpOnly attribute, It
provides Single Logout mechanism between
Authorization server and client application.
• If you are interested in it, please read the
specification
• Mobage Connect (my current work) supports it
2014年4月14日月曜日

21. Thanks
• If you have any question, talk to me in get-
together.
2014年4月14日月曜日