in play framework, how does secure.connected() work?

Question

new to play,

I noticed in tutorial and online documentation that play's secure model uses Security.connected() method to get current connected user.

my question is, how does it work ? how can play know who sent the last request ? does it use a cookie ?

if so, copying this cookie would allow me to use different computers for viewing page ?

Answer 1

Yes, Play use cookie to get the user information. The cookie itself is encrypted. Not sure if copy it to another computer allow you to view the page. But I think this is not a security leak. Say, if you have a secure word document, and you copy it to another computer, it will allow the user on that computer to view your doc.