ok, i know you get sick from this subject. me too :(

I've been developing a quite "big application" with PHP & kohana framework past 2 years, somewhat-successfully using my framework's authentication mechanism. but within this time, and as the app grown, many concerning state-preservation issues arisen.

main problems are that cookie-driven sessions:

• can't be used for web-service access ( at least it's really not nice to do so.. )
• in many cases problematic with mobile access
• don't allow multiple simultaneous apps on same browser ( can be resolved by hard trickery, but still.. )
• requires many configurations and mess to work 100% right, and that's without the --browser issues ( disabled cookies, old browsers bugs & vulnerabilities etc )

many other session flaws stated in this old thread : http://lists.nyphp.org/pipermail/talk/2006-December/020358.html

After a really long research, and without any good library/on-hand-solution to feet my needs, i came up with a custom solution to majority of those problems .

Basically, i'ts about emulating sessions with ajax calls, with additional security/performance measures:

• state preserved by interchanging SID(+hash) with client on ajax calls.
• state data saved in memcache(or equivalent), indexed by SID

• security achieved by:

  • appending unpredictible hash to SID
  • egenerating hash on each request & validating it
  • validating fingerprint of client on each request ( referrer,os,browser etc)

(*)condition: ajax calls are not simultaneous, to prevent race-condition with session token. (hopefully Ext-Direct solves that for me)

From the first glance that supposed to be not-less-secure than equivalent cookie-driven implementation, and at the same time it's simple, maintainable, and resolves all the cookies flaws.. But i'm really concerned because i often hear the rule "don't try to implement custom security solutions".

I will really appreciate any serious feedback about my method, and any alternatives.

• also, any tip about how to preserve state on page-refresh without cookies would be great :) but thats small technical prob.

• Sorry if i overlooked some similar post.. there are billions of them about sessions .

Big thanks in advance ( and for reading until here ! ).