Tanne

a program to substitute common sessions with PHP/HTTP

Deutsch English

What does Tanne mean?

The name Tanne comes from the TANs used within Online-Banking.

Where do I get Tanne?

Tanne is licensed under the GPL and can be downloaded here

What requirements does the Tanne have?

We use the Tanne on a Linux 2.2 system with GNU Libc 2.2. There are chances it will work on newer/older systems or other unices, but we have'nt tried yet.

Who stands behind the Tanne?

The Tanne was invented by FluxNetz GmbH for their own needs.
For questions, suggestions, critics or other comments please mail the adress found at www.fluxnetz.de We're looking forward to your feedback.

Why Tanne?

One drawback of HTTP is, that the connection between the "surfer" and the server is established just for viewing one page and not the entire session. This means you cannot tell that the "surfer" who successfully logged in is still the same viewing the next page.

Common solutions for this problem are cookies or sessions-IDs. Both have (for us) unacceptable drawbacks. Cookies have a bad reputation and require the "surfer" to accept them. Session-ids can be hijacked by spying the http-referrer or browser history.

Another problem is storing passwords (e.g. for MySQL) in PHP-Scripts. Because the scripts are world-readable (for apache to execute them), everybody with access to your server, can get the passwords from your script.

What concept stands behind Tanne?

login sequence:

• the surfer submits a form with login data
• apache starts a PHP-script (let's call it frontend, one call per page)
• the frontend connects to the Tanne-Daemon and sends the data
• the Tanne starts a backend program (any executable, e.g. PHP, perl, C, ...)

sequence with consecutive pages:

• the surfer requests a page
• apache restarts the frontend
• the frontend connects to the Tanne
• the Tanne knows which session is the right one and connects to the corresponding backend

From where does Tanne know which is the correct session?

The backend tells Tanne which commands are on a page. The Tanne creates a TID (a unique, long, random combination of numbers and letters). This TID will be transmitted to the frontend in place of the command. The frontend adds the TIDs to all links on a page, which are supposed to continue the session.

When the surfer clicks on one of the links, the frontend transmits the TID to the Tanne. The Tanne knows the corresponding session and which command is ment and then sends the command to the correct backend.

What advantages offers this concept?

• the backend runs under any permission (e.g. the permissions of a webhosting-client)
• the backend stays alive during the whole session and e.g. therefore can remember contents of fields within a session
• if one TID is used, all TIDs of the whole session become invalid. This way you know for sure, that an eventually spied TID is useless.