diff options
author | Claire <claire.github-309c@sitedethib.com> | 2021-11-06 00:13:58 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-11-06 00:13:58 +0100 |
commit | 6da135a493cc039d92bb5925c2a1ef66025623bf (patch) | |
tree | 552421ea76a507675a8b7e4bfa413e55b090f80d /app/javascript/flavours/glitch/features/direct_timeline/containers | |
parent | 87085a5152011b2f5595feba2a6c4d56a2b425f0 (diff) |
Fix reviving revoked sessions and invalidating login (#16943)
Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from *all* logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for *all* browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues.
Diffstat (limited to 'app/javascript/flavours/glitch/features/direct_timeline/containers')
0 files changed, 0 insertions, 0 deletions