View source for Identity/Verified Email Protocol/Latest-Session

__TOC__
''WikiMedia editor tip: If you aren't seeing numbered section headings in the body of this document, you can force them to appear by logging in and clicking the "My preferences" link, at left, and select "Auto-number headings"'' 

= Session Description Protocol Specification =

;DRAFT

== Terms ==

;Identity
:An email address which the user has control over.

;Web Site
:A Web site which has established one or more sessions with the browser, keyed on a specific Identity.

== Objects ==
Note: Object definitions below are written in Web IDL.

;SessionBinding

 interface SessionBinding {
     attribute string type;
     attribute string cookieName;
 }

;Session

A Session object describes an individual session the Web Site has with the current User Agent.

* The id attribute is the email address the session is associated with.
* The status may be "active", representing a "logged in" state, or "passive", representing a tracking session without an active log-in. The status field is optional, and defaults to "active".
* The binding attribute is a SessionBinding object.
* The terminate is a URL string. Optional.

 [Constructor]
 interface Session {
     attribute string id;
     attribute string status;
     attribute object binding;
     attribute string terminateURL;
 }

;SessionArray

(array of Sessions?)

== Browser-Level API ==

;navigator.id.sessions

Set by the Web Site to a SessionArray.

;navigator.id.terminateSession

Optionally set by the Web Site to a function;

WebIDL:

 module navigator {
     module id {
         attribute object sessions;
         attribute object terminateSession;
     }
 };

== Session Description ==

The Web Site [may?should?must?] set the navigator.id.sessions attribute to describe its current sessions to the User Agent.

== Session Termination ==

The Web Site MAY set the terminateURL property of a Session object to a URL, which the User Agent MUST load in the current top-level page of the Web Site, or in a new tab, except as described below. [XXX]

The Web Site MAY set the navigator.id.terminateSession attribute to a function of its choosing. If set, the User Agent MUST call this function upon session termination, and it MUST NOT fetch the terminateURL resource set in the Session object, if any.



== unorganized notes ==

1. Declaring a session is done by adding a session object to the
navigator.id.sessions array property. (note: there can be multiple
session objects)

2. A session object is a JavaScript object with the following properties:

* id:string, required. email address the session is associated with
* status: string, required. can be "active" or "passive"
* bound_to: object, required. contains these properties:
** type: string, required. only supported value is "cookie"
** cookie_name: string, required if type is "cookie". string of cookie
ID to bind lifetime of the session to.
* terminate_url: string, optional. url to load in the current tab if
user invokes logout from browser chrome

3. Session scope and lifetime

Sessions are valid only for the exact origin that declared the
session. No hierarchies or other schemes will be assumed by the user
agent. Multiple origins may declare sessions that are bound to the
same cookie, however. After a session is declared, the user agent may
assume the session is valid on a given page if the cookie it is bound
to was sent to the server.

That's it. In the future, the last rule may be relaxed slightly, and a
session may be assumed valid while loading a page on the same or
similar origin (i.e. under the same hierarchy), up until a certain
event has passed. This would allow larger multi-origin sites to
provide a seamless, flicker-free session UI across their site.






"Multiple origins may declare sessions that are bound to the
same cookie"

By this we mean multiple origins that share a root domain, i.e. finance.yahoo.com and health.yahoo.com, since that's the only way you can have different origins sharing a cookie.


"After a session is declared, the user agent may assume the session is valid on a given page if the cookie it is bound to was sent to the server"

*and* if the cookie value hasn't changed since the time the session was declared.





== References ==
* WebIDL: [http://www.w3.org/TR/WebIDL/ http://www.w3.org/TR/WebIDL/]