stokito / grails-cookie

Makes dealing with cookies easy. Provides an injectable service and tag to easily get, set, and delete cookies with one line
http://grails.org/plugin/cookie
16 stars 12 forks source link

Create cookie with random string #13

Closed mehul8236 closed 9 years ago

mehul8236 commented 9 years ago

I have added a function that would allow users to add a cookie with random string. It is very helpful when you wants to create a cookie with random alphanumeric values. A user has to provide random string size along with cookie name and good to go! :)

stokito commented 9 years ago

Hi @mehul8236 Thanks for your contribution. Could you give some examples when it may be useful?

stokito commented 9 years ago

It looks for me like not important functionality. I don't now what may be particular usage. Could you explain why you need it? I newer seen same functionality in other frameworks. Thus, unfortunatelly I can't merge this path to keep code base more simple and clear.

mehul8236 commented 9 years ago

Yes, I understand but if you wants to create a cookie with some random string and add it to session then you can always add some security logic from the cookie received and value that you stored in session that to authenticate user. that's what I did in my project.

stokito commented 9 years ago

Aha, I hope that I understood. You use it for storing Session Id in cookie. Basically it may be done by Grails itself. It uses cookie JSESSION_ID

Anyway, it's a rare special case that can be easily implemented when it need. So, again, it doesn't looks for me be worth to be in plugin. If someone vote and request for this patch, I will merge it.

If you want improve this plugin I would asking you to make tests for it https://github.com/stokito/grails-cookie/issues/16 Because currently it doesn't have any test, and that's disgusting

mehul8236 commented 9 years ago

Yes, I agree. but to use JSESSIONID cookie is vulnerable for the security. You can create a random cookie with jsesionid and you can always maximize the security by this approach.

stokito commented 9 years ago

JSESSIONID is already random seed

stokito commented 9 years ago

OK, I will close this issue.