Hacker News Reader

Parent Full thread

zelon88

In the proof of concept I linked, a self expiring session token is given to the client.

If it is returned before the expiry, a new token is generated and the process starts over.

If it is not returned before its expiry the session is considered to have been closed.

View on HN

But how are you storing the session token in the browser?

In a hidden DOM on the page. Updated asynchronously.

There is Javascript running on the page that updates the DOM.

So as long as the user is on the page, the "session" stays alive.

A session by definition extends beyond one page.

With some nastiness, you could make every link on the page a form submission and submit the session ID with the form. Then render it into the HTML that’s returned in response.

A rose by any other name would smell as sweet.

Reply on news.ycombinator.com