Cookies that &#39;*expire at end of the session*&#39; expire unpredictably from the user&#39;s perspective!

On iOS with Safari they expire whenever you switch apps!

On Android with Chrome they *don&#39;t* expire when you close the browser.

On Windows desktop running Chrome they expire when you close the browser. That&#39;s not when you close your website&#39;s tab; its when you close all tabs. Nor do they expire if there are any other browser windows open. If users run web apps as windows they might not even know they are browser windows. So your cookie&#39;s life depends on what the user is doing with some apparently unrelated app.

When you use `setcookie`, you can either set the expiration time to `0` or simply omit the parameter - the cookie will then expire at the end of session (ie, when you close the browser).

Just to correct mingos&#39; answer:

If you set the expiration time to 0, the cookie won&#39;t be created at all. I&#39;ve tested this on Google Chrome at least, and when set to 0 that was the result. The cookie, I guess, expires immediately after creation.

To set a cookie so it expires at the end of the browsing session, simply OMIT the expiration parameter altogether.

Example:

Instead of:  

    document.cookie = &quot;cookie_name=cookie_value; 0; path=/&quot;;

Just write:

    document.cookie = &quot;cookie_name=cookie_value; path=/&quot;;

End of the user session means when the browser is shut down.

Read this: http://en.wikipedia.org/wiki/HTTP_cookie#Expires_and_Max-Age

What I see is a string Layout property. But how can I pass a model to layout explicitly?

ASP.NET MVC Razor pass model to layout

Is there any way to use a `sizeof` in a preprocessor macro?

For example, there have been a ton of situations over the years in which I wanted to do something like:

    #if sizeof(someThing) != PAGE_SIZE
    #error Data structure doesn&#39;t match page size
    #endif

The exact thing I&#39;m checking here is completely made up - the point is, I often like to put in these types of (size or alignment) compile-time checks to guard against someone modifying a data-structure which could misalign or re-size things which would break them.

Needless to say - I don&#39;t appear to be able to use a `sizeof` in the manner described above.

How can I use &quot;sizeof&quot; in a preprocessor macro?

There is a session cookie with expiration time which says &#39;At end of session&#39;. 
When exactly does it expire or will it be alive forever? 


When does a cookie with expiration time &#39;At end of session&#39; expire?

<p>There is a session cookie with expiration time which says 'At end of session'.
When exactly does it expire or will it be alive forever?</p>


I want a php function which returns 55 when calling it with 52.


I&#39;ve tried the `round()` function: 

    echo round(94, -1); // 90

It returns *90* but I want *95*.


Thanks.

Round up to nearest multiple of five in PHP

I have found many sites that describes PRG, but no simple PHP code example.

-----

Here&#39;s what I implemented:

1. The `form.php` has an action: `validate.php`.
1. The `validate.php` is never seen by the user; if validates all `$_GET` and, if valid writes it to database and generates the HTML of a confirmation page / if not valid, it generates the HTML of an error page explaining what is wrong. 
1. Whichever HTML is generated get stored in a `$_SESSION` variable and then `validate.php` calls `header(&#39;Location: &lt;as appropriate&gt;);`.
1. The `submitted.php` of `invalid_input.php` (in case the user reads the URL) consists only of `echo $_SESSION[&#39;form_html&#39;];`.

That seems to me like protection against both page reload and back button problems.

Did I goof by trying to reinvent the wheel?

Simple PHP Post-Redirect-Get code example

I am running a website, and there is a scoring system that gives you points for the number of times you play a game.

It uses hashing to prove the integrity of http request for scoring so users cannot change anything, however as I feared might happen, someone figured out that they didn&#39;t need to change it, they just needed to get a high score, and duplicate the http request, headers and all.

Previously I&#39;d been prohibited from protecting against this attack because it was considered unlikely. However, now that it has happened, I can. The http request originates from a flash game, and then is validated by php and php enters it into the database.

I&#39;m pretty sure nonces will solve the issue, but I&#39;m not exactly sure how to implement them. What is a common, and secure way of setting up a nonce system?

How to create and use nonces

After screwing up entirely my PHP configuration on MAC trying to get the SOAP module working (-bash: /usr/bin/php: No such file or directory
....) I now have to use MAMP but each time I have to type the path 

    Applications/MAMP/bin/php5.3/bin/php to do command line.

**How to just type php instead the entire path on MAC ?** I double checked and i do not have a file named `.profile` nor `bash_profile`

Thanks

PS: Here&#39;s what output echo $PATH : 

    echo $PATH
    /Applications/MAMP/Library/bin/:/Applications/MAMP/bin/php5/bin/:/opt/local/bin:/opt/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/local/git/bin:/usr/X11/bin



How to override the path of PHP to use the MAMP path?

Let me start right off the bat by saying that I know this is not the best solution. I know it&#39;s kludgy and a hack of a feature. *But that&#39;s why I&#39;m here!*

This question/work builds off [some discussion on Quora with Andrew Bosworth][1], creator of Facebook&#39;s news feed.

**I&#39;m building a news feed** of sorts. It&#39;s built solely in `PHP` and `MySQL`.

![alt text][2]

----------


## The MySQL ##

The relational model for the feed is composed of two tables. One table functions as an activity log; in fact, it&#39;s named `activity_log`. The other table is `newsfeed`. *These tables are nearly identical.*

The **schema for the log** is `activity_log(uid INT(11), activity ENUM, activity_id INT(11), title TEXT, date TIMESTAMP)`

...and the **schema for the feed** is `newsfeed(uid INT(11), poster_uid INT(11), activity ENUM, activity_id INT(11), title TEXT, date TIMESTAMP)`.

**Any time a user does something** relevant to the news feed, for example asking a question, **it will get logged to the activity log** immediately.

----------

## Generating the news feeds ##

Then **every X minutes** (5 minutes at the moment, will change to 15-30 minutes later), **I run a cron job** that executes the script below. This script loops through all of the users in the database, finds all the activities for all of that user&#39;s friends, and then writes those activities to the news feed.

At the moment, the `SQL` that culls the activity (called in `ActivityLog::getUsersActivity()`) has a `LIMIT 100` imposed for performance* reasons. *Not that I know what I&#39;m talking about.

    &lt;?php
    
    $user = new User();
    $activityLog = new ActivityLog();
    $friend = new Friend();
    $newsFeed = new NewsFeed();
    
    // Get all the users
    $usersArray = $user-&gt;getAllUsers();
    foreach($usersArray as $userArray) {
      
      $uid = $userArray[&#39;uid&#39;];
      
      // Get the user&#39;s friends
      $friendsJSON = $friend-&gt;getFriends($uid);
      $friendsArray = json_decode($friendsJSON, true);
      
      // Get the activity of each friend
      foreach($friendsArray as $friendArray) {
        $array = $activityLog-&gt;getUsersActivity($friendArray[&#39;fid2&#39;]);
        
        // Only write if the user has activity
        if(!empty($array)) {
          
          // Add each piece of activity to the news feed
          foreach($array as $news) {
            $newsFeed-&gt;addNews($uid, $friendArray[&#39;fid2&#39;], $news[&#39;activity&#39;], $news[&#39;activity_id&#39;], $news[&#39;title&#39;], $news[&#39;time&#39;]);
          }
        }
      }
    }


----------

## Displaying the news feeds ##

In the client code, when fetching the user&#39;s news feed, I do something like:

    $feedArray = $newsFeed-&gt;getUsersFeedWithLimitAndOffset($uid, 25, 0);

    foreach($feedArray as $feedItem) {

    // Use a switch to determine the activity type here, and display based on type
    // e.g. User Name asked A Question
    // where &quot;A Question&quot; == $feedItem[&#39;title&#39;];

    }


----------

## Improving the news feed ##

Now forgive my limited understanding of the best practices for developing a news feed, but I understand the approach I&#39;m using to be a limited version of what&#39;s called **fan-out on write**, limited in the sense that I&#39;m running a cron job as an intermediate step instead of writing to the users&#39; news feeds directly. But this is very different from a pull model, in the sense that the user&#39;s news feed is not compiled on load, but rather on a regular basis.

This is a large question that probably deserves a large amount of back and forth, but I think it can serve as a touchstone for many important conversations that new developers like myself need to have. I&#39;m just trying to figure out what I&#39;m doing wrong, how I can improve, or how I should maybe even start from scratch and try a different approach.

One other thing that bugs me about this model is that it works based on recency rather than relevancy. If anyone can suggest how this can be improved to work relevancy in, I would be all ears. I&#39;m using Directed Edge&#39;s API for generating recommendations, but it seems that for something like a news feed, recommenders won&#39;t work (since nothing&#39;s been favorited previously!).


  [1]: http://www.quora.com/What-are-best-practices-for-building-something-like-a-News-Feed
  [2]: http://i.stack.imgur.com/KPvit.gif

How can I improve this PHP/MySQL news feed?

I am writing a Asp.net MVC 2 application that uses Forms Authentication and currently I am having a problem with our iPhone application in regards to the authentication/login over the web. We have developed a simple iPhone app that uses the the UIWebView control. At this stage, all the app does is navigate to our Asp.Net website. Simple, right? The problem is, that the user cannot get past the login page. The repro steps are:

 * Open iPhone app.
 * The app navigates to the home page.
 * the user is not authenticated, so they are redirected to the login screen/page
 * The user enters the correct user name and password. clicks submit.
 * on the server side, the user is authenticated and a cookie is generated and sent to the client using FormsAuthentication.GetAuthCookie.
 * The server sends are redirect to send the user to the correct home page.

But the user is then redirected &lt;b&gt;BACK&lt;/b&gt; to the login screen!

I&#39;ve done some extensive debugging on this and what I do know is: 

The cookie is being sent to the client, and the client is storing the cookie. Verified this in the iPhone debugger and also by using Javsascript to display cookie data on the page. The cookie is being sent back to the server. Verified this in the Visual Studio debugger. It is the correct cookie (it&#39;s the same one that was set). The property User.Identity.IsAuthenticated returns false for some reason, even though the auth cookie is contained in the Request object.  I have verified that the iPhone app is setup to accept cookies, and they are on the client.

Here is the funny thing: It works fine if you open the Safari browser on the iPhone and go to our site directly. 

It has the same behaviour on the iPad too in that it doesn&#39;t get past the login screen. This repros on the emulators, and on devices.

This same web site has been tested with IE 7-8, Safari (for Windows), Blackberry, IEMobile 6.5, Phone 7 and it works find. The only circumstance that it doesn&#39;t work on is the UIWebView in the iPhone app.


 

Asp.Net Forms Authentication when using iPhone UIWebView

When I create a cookie, how to get cookie&#39;s expire time?

How to get cookie&#39;s expire time

How do I save JSON data in a cookie?

My JSON data looks like this

    $(&quot;#ArticlesHolder&quot;).data(&#39;15&#39;, {name:&#39;testname&#39;, nr:&#39;4&#39;,price:&#39;400&#39;});
    $(&quot;#ArticlesHolder&quot;).data(&#39;25&#39;, {name:&#39;name2&#39;, nr:&#39;1&#39;, price:&#39;100&#39;});
    $(&quot;#ArticlesHolder&quot;).data(&#39;37&#39;, {name:&#39;name3&#39;, nr:&#39;14&#39;, price:&#39;60&#39;});

And I want to do something like

    var dataStore = $.cookie(&quot;basket-data&quot;, $(&quot;#ArticlesHolder&quot;).data());

and to retrieve the data i want to load it into `$(&quot;#ArticlesHolder&quot;)` like

    $.each($.cookie(&quot;basket-data&quot;), function(i,e){
     $(&quot;#ArticlesHolder&quot;).data(i, e);
    });


does anyone know if I&#39;m on the right track or should this be done in some other way? Simply put, how do i put and pull json data from a cookie?



jquery save json data object in cookie

Are there any issues with sending back a cookie during a 302 redirect? For example, if I create a return-to-url cookie and redirect the user in the same response will any (modern) browser ignore the cookie?

Sending browser cookies during a 302 redirect

I was browsing Facebook&#39;s documentation reading about canvas applications and I came across an example application: http://developers.facebook.com/docs/samples/canvas. As I read through their example, however, I got very confused about their use of cookies in the iframe application.

A little backstory...

I had already played around with using iframes for embeddable widgets (unrelated to Facebook) and I found out a few browsers (Chrome, Safari, etc.) have strict cookie policies and don&#39;t allow cross-domain cookies set in iframes (Firefox, on the other hand, allows iframes to set cross-domain cookies in iframes). For example, if foo.com has an iframe with `src=&quot;http://bar.com/widget&quot;` the iframe widget will not be able to set any cookies for bar.com and therefore will have trouble persisting state within the iframe: bar.com will interpret every request (including ajax requests) from the widget as a fresh request without an established session. I struggled, and found a way around this by using JSONP and javascript to set cookies for foo.com instead...

... and so?

Well, I was looking at the example canvas iframe Facebook application and I noticed that their application (hosted on runwithfriends.appspot.com) is able to set a cookie, `u`, with the current user&#39;s id along with a few other parameters for the runwithfriends.appspot.com domain. It sends this cookie with every request... and it works in both Chrome and Firefox! WTF? How does Facebook get around the cross-domain cookie restrictions on Chrome?

(I already know the answer now, but I thought this might be helpful for anyone struggling to figure out the same thing -- I&#39;ll post the answer below.)

Content Type	Original Author	Original Content on Stackoverflow
Question	Shakti Singh	View Question on Stackoverflow
Solution 1 - Php	James	View Answer on Stackoverflow
Solution 2 - Php	mingos	View Answer on Stackoverflow
Solution 3 - Php	J.Smith	View Answer on Stackoverflow
Solution 4 - Php	shamittomar	View Answer on Stackoverflow

When does a cookie with expiration time 'At end of session' expire?

Php Problem Overview

Php Solutions

Solution 1 - Php

Solution 2 - Php

Solution 3 - Php

Solution 4 - Php

How can I use "sizeof" in a preprocessor macro?

ASP.NET MVC Razor pass model to layout

Attributions