Web client stayed logged in when using multiple tabs

[ineffyble]

Steps to replicate:

• Log in to the web client
• Open a new tab
• Log out in the second tab
• Log in to another account in the second tab
• Switch to first tab
• Toot

Expected: Error message, or first tab client logs out

Actual: Toot is successfully published from the first account

---

• I searched or browsed the repo’s other issues to ensure this is not a duplicate.
• This bug happens on a tagged release and not on master (If you're a user, don't worry about this).

[ashfurrow]

Yikes!

[Gargron]

This shouldn't be weird really? Web client uses an OAuth access token. While your page is open, the access token stays the same so you can keep using the API. If you reload the page you won't have access to the access token anymore.

[daprice]

This might be worse than previously thought. On iOS Safari I can do the following:

1. Start with a tab logged in to mastodon
2. log out
3. close the tab
4. leave the browser and come back to it later
5. reopen the closed tab from history by holding down the "+" button
6. press the back button to get back to the timeline

…and be able to toot/favorite/boost without having to enter any credentials. This has to do with Safari saving the page state along with browsing history, and I believe Firefox/Chrome do something similar.

As far as I can tell, this means that in order to prevent someone else from gaining complete access to their account, a user on a shared device would have to either (a) reset the browser (i.e. clear history, cookies, and any saved window/tab state) when finished using Mastodon, or (b) only ever use Mastodon with private browsing and close the tab after logging out.

[Gargron]

So uh.. I guess we could store the access token in a cookie then? Instead of having it in the HTML.

[daprice]

Regardless of where the access token is stored, shouldn't it be invalidated on the server side when the user logs out, per https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Manual_Session_Expiration ?