removal of unique_session_id on explicit user logout #59

Open
wants to merge 3 commits into
from

Conversation

Projects
None yet
3 participants
@klobuczek

This change cleans up the unique_session_id from the db when the user logs out. This was necessary as our security department objected that if the user logs out, but the response for some reason doesn't reach the client, or the response is maliciously intercepted, or the browser (or modification of it) doesn't properly invalidate the cookie, or the cookie has been copied before logout, the system can still be accessed using the cookie.

I had to add the conditional to preserve the current behavior of the gem.

@mrcsparker

This comment has been minimized.

Show comment Hide comment
@mrcsparker

mrcsparker Oct 11, 2013

Is there any update on when this will get added? I really need this also.

Is there any update on when this will get added? I really need this also.

@rahim

This comment has been minimized.

Show comment Hide comment
@rahim

rahim Nov 19, 2014

+1

I recently had to implement similar myself for the same reasons - it feels like this should be the default behaviour of session limitable - if you're explicitly blocking concurrent sessions then an old session should be invalidated as soon as we know this. Sometimes this may still only be at next login, but where we know this earlier (through explicit logout) we can minimise the window that a leaked session cookie would be useful to an attacker.

rahim commented Nov 19, 2014

+1

I recently had to implement similar myself for the same reasons - it feels like this should be the default behaviour of session limitable - if you're explicitly blocking concurrent sessions then an old session should be invalidated as soon as we know this. Sometimes this may still only be at next login, but where we know this earlier (through explicit logout) we can minimise the window that a leaked session cookie would be useful to an attacker.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment