1 From the login response, get a session cookie.

2 Obtaining the Domino session cookie is an important part of the process, and you can use the same code in other Domino-related applications.

3 By including a session cookie, the Domino server thinks that your script is actually a human user who recently logged in and is now accessing the database.

4 You can find the Domino session cookie in the Set-Cookie response header.

5 If a session cookie has been detected, then the URL generated by Listing 14 will be like the one in Listing 15.

6 When no session cookie is present,[] the URL in Listing 16 is the result.

7 You tell Domino your identity by appending a session cookie to the request headers.

8 Application Server only creates the session cookie for this user and assumes that this user has been authenticated.

9 It requests that the portal creates a session cookie whenever a page containing the portlet is accessed, even if no user login exists.

10 You get the session cookie by sending a POST request to the Domino server.

11 A session cookie in conjunction with a random auth token or auth login validation is both reasonable mechanisms.

12 An attacker can take over the user session before the user's session cookie expires.

13 However, for this code to work, the CherryPy server needs to be set up to associate a session cookie with each HTTP response.

14 Use a tool (see Resources) to determine whether a response contains a session cookie, in which case the request is considered to be authenticated.

15 If you don't need sessions, the session handler can be removed so we don't even waste the cycles looking for a session cookie.

16 A user is prompted for a user name and password and given a session cookie or session header.

17 When a user authenticates for the first time, the PHP application, after retrieving the session cookie, asks this agent for the location of the user's mail file.

18 Think of a situation where an attacker has stolen a user's session cookie and thus may co-use the application.