Session management via pure CGI
Question: I'm currently in the process of writing a little blog / generic posting system
using CGI in C as a hobby project and am now in the need of a session
management system to authentificate authorized users for posting, editing and
similar operations over **multiple CGI programs**

From working with PHP years ago I remember using the superglobal variable
`$_SESSION` and some session intializing functions. _Obviously_ this is not
going to work this way when dealing with pure CGI, so I'm in a tricky
situation here.

A bit of thinking showed that there's many different ways to do such a
thing...

  1. Saving the IP address and attributes inside a file where I can see if a particular IP is authorized
  2. Same as #1 but using an SQLite database (my engine already runs on SQLite so there would be no additional overhead)
  3. Something with cookies maybe?

Instead of going all in and regret is later... what do **you** good people
think? What's the most efficient (and most importantly) and the maintainable
method?

Please note that I do _not_ want to get a third party libary to do all the
complicated things for me! I started this project to build something
completely by myself (if you ignore SQLite here) and I don't want to hide the
hard parts, even if it makes everything so much simpler. I could have just
used Python if I didn't want to torture myself :)


Answer: Cookie based session management is the way to go. You cannot merely use an IP
address not even IP address + browser combination because that will fail when
people are using proxy or are behind NAT.

Just send the browser a hash in a cookie, then validate the hash against your
record for the user, if it matches, you can then access the data for that
user's session.

Consider adding an expiry mechanism for the hash. There is a trade off between
security and ease of use, because the longer the same hash is valid for the
user, the longer the user is vulnerable to a cookie stealing attack.

Expiry mechanisms will also enable you to delete stale session data from your
database (or file, if you would so choose.)

