feat(auth): log out users deactivated mid-session#40675
Draft
rusackas wants to merge 1 commit into
Draft
Conversation
Flask-Login only checks is_active when establishing a login; for an already-authenticated user it does not re-check it per request, so a user disabled by an administrator keeps their session until it expires (FINDING-018 / ASVS 7.4.2, CWE-613). Add a before_request hook that re-checks current_user.is_active and logs the user out as soon as their account is deactivated; the request then proceeds as anonymous and the normal access controls deny protected views. Deleted users are already handled (the user loader returns None). No migration required; auth/login/logout/static/health endpoints are exempt to avoid loops. This implements the immediate disable/delete case from the SIP (Part A2); the broader "invalidation epoch" (revoke sessions without deactivating) remains a future enhancement. DRAFT: runs on the authenticated request path; needs end-to-end validation (disable a logged-in user, confirm next request is denied; confirm normal users and the login/logout flow are unaffected) before merge. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #40675 +/- ##
==========================================
- Coverage 64.18% 63.81% -0.38%
==========================================
Files 2591 2652 +61
Lines 138471 142187 +3716
Branches 32120 32573 +453
==========================================
+ Hits 88883 90737 +1854
- Misses 48056 49884 +1828
- Partials 1532 1566 +34
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
rusackas
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Flask-Login only consults
is_activewhen establishing a login; for an already-authenticated user it does not re-check it on subsequent requests. So a user an admin deactivates keeps their session until it expires (FINDING-018 / ASVS 7.4.2, CWE-613).This adds a
before_requesthook that re-checkscurrent_user.is_activeand logs the user out as soon as their account is deactivated. The request then continues as anonymous, and the normal access controls deny protected views. Deleted users are already handled (the user loader returnsNone). No migration —auth/login/logout/static/healthendpoints are exempt to avoid loops.This implements the immediate disable/delete case from the SIP (#40674, Part A2). The broader "invalidation epoch" (revoke sessions without deactivating the account) remains a future enhancement described in that SIP.
WHY DRAFT (
hold:testing)Adds a check on every authenticated request. Needs validation that: a disabled logged-in user is denied on their next request; normal active users and the login/logout/OAuth flows are unaffected; and the exemption list matches real endpoint names (no loop).
TESTING INSTRUCTIONS
Unit test covers the endpoint-exemption logic. Before merge: disable a logged-in user and confirm their next request is denied; confirm active users and login/logout are unaffected.
ADDITIONAL INFORMATION
🤖 Generated with Claude Code