session_security breaks "End Session" on the current session when using user_sessions

[sdann]

The middleware

user_sessions.middleware.SessionMiddleware

Provides a listing of a user's sessions across various clients. The user can then choose to "End Session" on any of their existing sessions, including their current session they are logged in as.

When using the user_sessions middleware alone, clicking "End Session" will behave the same way as "Logout". Unfortunately, when combined with the session_security middleware, clicking "End Session" on the current session has no effect.

With some pdb tracing, I've figured out the following rough series of events:

1. request:session_security updates the last_activity in the session
2. request:user_sessions deletes the session object
3. response:user_sessions detects the session was modified in step 1) and re-saves the session to the backing DB

The user is redirected to the same Session List page, with their current session still active.

[sdann]

As a fix, I propose enhancing the SESSION_SECURITY_PASSIVE_URLS parameter to understand URLs with parameterized arguments, instead of just static strings.

The URLs in this instance look like this:

http://127.0.0.1:8000/account/sessions/5srnkbv9rczmud7v7zp0oi8t76b6fgwm/delete/

Where the 3rd entry in the path is the session ID. PR coming soon.

[sdann]

The original issue for which I submitted this patch has been fixed in the user_sessions module.

However, I think this is still the better way to do PASSIVE URLS (DRY).

[jpic]

Hi ! Thanks a lot for your contribution ! Would this work for you ?

from django.core.urlresolvers import reverse_lazy as reverse
SESSION_SECURITY_PASSIVE_URLS = [reverse('session_delete')]

[sdann]

Hey @jpic

I don't think reverse_lazy will work here, because the URL is parameterized with the session token.

http://127.0.0.1:8000/account/sessions/5srnkbv9rczmud7v7zp0oi8t76b6fgwm/delete/

There's no way for us to pass this dynamic portion of the URL (5srnkbv9rczmud7v7zp0oi8t76b6fgwm) into the static SESSION_SECURITY_PASSIVE_URLS parameter in the existing code.

A quick attempt returns a NoReverseMatch exception.

[jpic]

Hi @sdann

Sounds fair, I think we'd like to merge this, care to add a unit tests or two and a bit of doc for the new setting ?

Thanks

[sdann]

Indeed. Was on vacation last week. I'll try to add some testing and docs to the PR by end of the week.