Project

General

Profile

Actions

Bug #2351

closed

AuthModel doesn't clean up database when handling log out

Added by Ben Jackson about 11 years ago. Updated over 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Roel Standaert
Target version:
Start date:
10/21/2013
Due date:
% Done:

0%

Estimated time:

Description

As indicated by the comment in the source code, AuthModel::logout() deletes the user's cookie but doesn't remove the record of that cookie from the database. This unnecessarily extends the time window during which an attacker capable of acquiring the user's cookie could access the site with stolen credentials.

Actions #1

Updated by Koen Deforche over 10 years ago

  • Status changed from New to InProgress
  • Assignee set to Roel Standaert
  • Target version set to 3.3.3

We probably need to expand the AbstractUserDatabase API to remove a token given its hash which is in app~~environment().getCookieValue(baseAuth()~~>authTokenCookieName())

Actions #2

Updated by Roel Standaert over 10 years ago

  • Status changed from InProgress to Resolved
Actions #3

Updated by Koen Deforche over 10 years ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF