mirror of
https://github.com/lunaisnotaboy/mastodon.git
synced 2024-08-14 20:14:54 +00:00
Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from *all* logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for *all* browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues. |
||
---|---|---|
.. | ||
activitypub | ||
admin | ||
api | ||
auth | ||
concerns | ||
oauth | ||
settings | ||
well_known | ||
about_controller.rb | ||
account_follow_controller.rb | ||
account_unfollow_controller.rb | ||
accounts_controller.rb | ||
application_controller.rb | ||
authorize_interactions_controller.rb | ||
custom_css_controller.rb | ||
directories_controller.rb | ||
emojis_controller.rb | ||
filters_controller.rb | ||
follower_accounts_controller.rb | ||
following_accounts_controller.rb | ||
health_controller.rb | ||
home_controller.rb | ||
instance_actors_controller.rb | ||
intents_controller.rb | ||
invites_controller.rb | ||
manifests_controller.rb | ||
media_controller.rb | ||
media_proxy_controller.rb | ||
public_timelines_controller.rb | ||
relationships_controller.rb | ||
remote_follow_controller.rb | ||
remote_interaction_controller.rb | ||
shares_controller.rb | ||
statuses_cleanup_controller.rb | ||
statuses_controller.rb | ||
tags_controller.rb |