security: forcibly expire old sessions #69

justcool393 · 2022-12-14T23:59:37Z

justcool393 commented

2022-12-14 23:59:37 +00:00

this helps to guard against a replay attack with session cookies.
we use the session for a number of things, including logged in status,
history, poorcel mode, etc. a user can be logged in indefinitely by
replaying their session cookie or doing something which resets the timer
(ex. toggling poor mode). this adds a session expiration to whatever the
SESSION_LIFETIME constant is, which shouldn't be too restrictive (login
sessions being valid for 1 year).

this helps to guard against a replay attack with session cookies. we use the session for a number of things, including logged in status, history, poorcel mode, etc. a user can be logged in indefinitely by replaying their session cookie or doing something which resets the timer (ex. toggling poor mode). this adds a session expiration to whatever the SESSION_LIFETIME constant is, which shouldn't be too restrictive (login sessions being valid for 1 year).

🎉 1

justcool393 added 1 commit 2022-12-14 23:59:38 +00:00

f19eefcfe7 security: forcibly expire old sessions

this helps to guard against a replay attack with session cookies.
we use the session for a number of things, including logged in status,
history, poorcel mode, etc. a user can be logged in indefinitely by
replaying their session cookie or doing something which resets the timer
(ex. toggling poor mode). this adds a session expiration to whatever the
SESSION_LIFETIME constant is, which shouldn't be too restrictive (login
sessions being valid for 1 year).

Aevann commented

2022-12-22 16:36:01 +00:00

fixes problem that doesnt exist

Aevann closed this pull request

2022-12-22 16:36:02 +00:00

Aevann commented

2022-12-22 16:36:17 +00:00

check discord DMs