Session ID's / User Tracking

[1DMF]

Hello,

I have an affiliate script which creates a cookie to track the user against referring affiliate.

However obviously this breaks with cookies disabled!

On another forum it was suggested that a session ID is created and put in the DB, to cross reference with later.

So can someone advise how you would do this in perl, how do you generate a key based on the users machine and cross reference it later?

If you can't 'write' anything to their machine not even cookies, how do you 'tag' the machine for identifying later?

IP is not good enough due to NAT, so is there a way of getting the MAC-ID of the NIC and storing with IP?

How do you get a unique ID for a users machine when they hit a website so you can then track them?

Regards,

1DMF

"In complete darkness we are all the same, only our knowledge and wisdom separates us, don't let your eyes deceive you."

"If a shortcut was meant to be easy, it wouldn't be a shortcut, it would be the way!

 

[travs69]

There is a lot on google (search for perl session cookies) but here is what I do.

You create the sessionid and store what ever you want about that sessionid in the database. I write that sessionid to the cookie (that's the only thing I put in the cookie) but I also add it as part of the URL as they go through the site (in case they have cookies disabled). I have the session timeouts reset for every page they go to and I have a maximum total life time of the session (so if you are on the site every 5 min you will expire after 4 hours anyway, or if you are inactive for 10 min you will expire). I limit every session to the same IP it was created from (helps prevent session hijacking).

If they have cookies disabled, and leave the site, they have to log back in again. If their session expires and they hit the back button (with out using ajax or something) they will still see content on the site (everyone comes here asking about this, it's their browser caching the page).. but if they click on anything or try do do anything they will get prompted for a login again.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Travis - Those who say it cannot be done are usually interrupted by someone else doing it; Give the wrong symptoms, get the wrong solutions;

 

[1DMF]

I thought you were going to say add it to the URL, this would then screw with the 301 redirect and G!'s indexing.

I've thought about possibly having it as a hidden field instead but that would require every action/hyperlink to submit the hidden form field, rather than be a straight forward hyperlink.

Basically there is no easy way from what I can tell, nightmare!


"In complete darkness we are all the same, only our knowledge and wisdom separates us, don't let your eyes deceive you."

"If a shortcut was meant to be easy, it wouldn't be a shortcut, it would be the way!