Repository navigation
Old sessions are not deleted when account is deleted #1492
Description
We let people delete their accounts, but we don't nuke their active sessions when they do so. We should do that. If we don't, there's no way for a user to nuke those sessions.
Activity
mlissner commentedon Dec 2, 2020
OK, first things first. I guess I don't care of a session is still active after an account is deleted. If that's the case, it's not like you can do anything. The data for the account is nuked, and if you try to create more data by creating a favorite or something, it'll surely explode.
What I do think is worth investigating is how to nuke sessions during a password change.
mlissner commentedon Dec 2, 2020
Actually, it looks like sessions are invalidated with password changes: https://docs.djangoproject.com/en/1.11/topics/auth/default/#session-invalidation-on-password-change. I think I'm done here.
fix(security): Nuke all sessions during account deletion
mlissner commentedon Dec 3, 2020
On second thought, changing your password only invalidates sessions if you do it via one of the password change forms. If you do it via the change password method, as we do, you have to explicitly nuke other sessions (there's a command for this, as above). So....I implemented that in #1493.