banner/docs/Sessions.md

Sessions

All notes on the internal workings of Sessions in the Banner system.

• Sessions are generated on demand with a random string of characters.
• Sessions are invalidated after 30 minutes, but may change.
  • This delay can be found in the original HTML returned, find meta[name="maxInactiveInterval"] and read the content attribute.
  • This is read at runtime by the javascript on initialization.
• Multiple timers exist, one is for the Inactivity Timer.
  • A dialog will appear asking the user to continue their session.
  • If they click the button, the session will be extended via the keepAliveURL (see meta[name="keepAliveURL"]).
  • The keepAliveURL does not seem to care whether the session is or was ever valid, it will always return a 200 OK with I am Alive as the content.
• When searching with an invalid session (or none at all, as the case may be), the server will return 200 OK, but with an empty result response structure.

  • {
        "success": true,
        "totalCount": 0,
        "data": null,    // always an array, even if empty
        "pageOffset": 0,                  //
        "pageMaxSize": 10,
        "sectionsFetchedCount": 0,
        "pathMode": "registration",   // normally "search"
        "searchResultsConfigs": null,  // normally an array
        "ztcEncodedImage": null  // normally a static string in base64
    }
    

    
  - This is only the handling for the search endpoint, more research is required to see how other endpoints handle invalid/expired sessions.
  - TODO: How is `pathMode` affected by an expired session, rather than an invalid/non-existent one?