How to maintain Session in a three-tier program written by Delphi WebService architecture

Origin of the problem:

If it is a remote service based on TCP/IP long connection, such as DataSnap recommended by the new version of Delphi, it supports TCP long connection based on client and server. The server can even call back the client through this connection and initiate active notification to the client. Then, a Session is such a long connection.

However, WEB access is a short connection. One operation, one connection is established, the operation is completed, and the connection is disconnected. Next time, reconnect. Therefore, if the user continues other operations after logging in, how does the server know whether the connection for the next operation or the client logged in last time?

There are several ways to do it on the WEB Server accessed by web pages:

1. Use cookies to track the client;

2. Use hidden fields in the form of the web page, that is, they are not displayed on the page, but there is in the HTML code of the front end of the page. After the page is submitted, the server can read the contents of such hidden fields, knowing that the page is logged in before Who

3. Use URL parameters. Similar to http://abcd.com/readDoc?docNumb=123456; here is the URL parameter after the question mark. Many websites use this method.

4. There may be other ways I don't know. Please know the message.

So, what is the way to use Delphi to develop WebService based on WEB access?

---------------

Ways Delphi can use:

1. SOAP Header: The methods that can be searched on the Internet all talk about using Soap Header. You need to define a class inherited from TSoapHeader to store the Session value obtained from the server after the user logs in or simply the client's own user name and The password, in short, is to pass parameters to the server through this Soap Header, and the server-side code reads this Soap Header to obtain the parameters to know who the client is.

2. Cookie: This is a function I found out by myself. It was a very useful function, but under the new version of Delphi, it is a little troublesome.

3. URL parameters. It's simple and easy to use. But online search for Delphi WebService Soap, etc., there is no relevant information. Maybe it's too simple?

----------------------------

Based on the Soap Header method, the biggest problem is that every time the client calls the server-side method, it must call the method of sending the Soap header in advance. That is, the amount of code has increased. Even if the client opens a TClientDataSet or submits a TClientDataSet through TSoapConnection, it needs to execute the code to send the Soap Header first.

Use cookies, because cookies are transparent to the client, and the client does not need to deal with it at all. As long as the server sets a Cookie for the client, the server can read the Cookie every time the client visits in the future, and the cookie can tell who the client is. Very good way. I also wrote a blog about how to use cookies before: Cookie operation of Delphi's WebService

Problems using cookies:

1. In order to facilitate the operation, I usually put a THTTPRIO and a TSoapConnection on the client side, use THttpRio to call the server-side interface method, and use the MIDAS-based three-tier database architecture through TSoapConnection. You can get data without writing code and submit Data, reduce code workload.

2. In the above situation, use HttpRio to call the server-side login method. The server-side checks the parameters such as the username and password submitted by the client in this method. After the login is successful, the server-side creates a Cookie for the client to record the client's parameters. In the future, whether it is HttpRio calling the server-side interface or ClientDataSet to read and write the database through SoapConnection, the server-side can read the Cookie created for the client before, and know who the client is based on the parameters.

3. However, the new version of Delphi uses HttpRIO1 to call server-side methods. Cookies created by the server-side can only be read by the server-side when this HttpRio1 calls other server-side methods again; if HttpRIO2 or SoapConnection1 is used to operate the server On the server side, the cookie created before cannot be read on the server side. That is to say, the multiple HttpRio and SoapConnection instances in the client of the new version of Delphi do not share the cookies created by the server.

3.1. The method to solve the above problem is a bit more troublesome, that is, even if it is to call the server-side method, use SoapConnection1.RIO to call, instead of using another HttpRio1 to call. However, in order for SoapConnection1.RIO to call the server-side interface methods, you need:

  SoapConnection1.Connected := False;
  SoapConnection1.SOAPServerIID := '{A4E625D6-1BC4-4335-BEF4-669113CA65B4}';  //这个 ID 是你用 Delphi 写的 WebService 服务器端的接口的 IID
  SoapConnection1.Connected := True; //设计期关掉连接。运行期设置这个为 True

Regarding the above method, Delphi's official help says this:

If the server includes more than one remote data module, you must indicate the target data module's interface (an IAppServerSOAP descendant) so that TSOAPConnection can identify the remote data module you want to use. There are two ways to do this:

Set the SOAPServerIID property to indicate the interface of the target remote data module. This method works for any server that implements an IAppServerSOAP descendant. SOAPServerIID identifies the target interface by its GUID. At runtime, you can use the interface name, and the compiler automatically extracts the GUID. However, at design time, in the Object Inspector, you must specify the GUID string.
If the server is written using the Delphi language, you can simply include the name of the SOAP data module's interface following a slash at the end of the path portion of the URL. This lets you specify the interface by name rather than GUID, but is only available when both client and server are written in Delphi.

---------------------------------------------------------------

Use URL parameters:

We use HttpRio1 or SoapConnection1 to connect to the server. If the server is written in Delphi, you usually only need to set its URL to:

https://127.0.0.1:8080/soap

You can interact with the server.

Then, when the client calls the server-side login method, the server-side can generate a Session ID for the client, such as a string of numbers 13559, which is returned to the client through this login function, then the client can change the above URL to: https://127.0.0.1:8080/soap?session=13579

Then, whether it is ClientDataSet1.Open or ClientDataSet1.ApplyUpdates or use HttpRIO1 to call an interface method on the server side, on the server side, you can read this session=13579; the client only needs one line of code, which is to modify the URL, and all the following The operation is automatically submitted, no other code is required . The method for the server to read this parameter is:

ID := GetSOAPWebModule.Request.QueryFields.Values['session'];

explain:

On the server side , GetSOAPWebModule is declared in the Soap.WebBrokerSOAP unit, which is a global function and returns TWebModule. As long as it uses Soap.WebBrokerSOAP, it can be used. Request represents the client's request, through which you can read the client's URL parameters. Before we read the client's Cookie is also obtained using GetSOAPWebModule.

In fact, using the WebBroker framework in Delphi to write a web server program that uses the browser page to access, it is also through this TWebModule to manipulate the request to the client and the content response to be sent to the client.