mirror of https://github.com/mastodon/mastodon
6da135a493
Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from *all* logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for *all* browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues. |
3 years ago | |
|---|---|---|
| .. | ||
| environments | 4 years ago | |
| initializers | 3 years ago | |
| locales | 4 years ago | |
| webpack | 4 years ago | |
| application.rb | 4 years ago | |
| boot.rb | 4 years ago | |
| brakeman.ignore | 4 years ago | |
| database.yml | 6 years ago | |
| deploy.rb | 4 years ago | |
| environment.rb | ||
| i18n-tasks.yml | 5 years ago | |
| navigation.rb | 4 years ago | |
| pghero.yml | 5 years ago | |
| puma.rb | 6 years ago | |
| routes.rb | 4 years ago | |
| secrets.yml | ||
| settings.yml | 4 years ago | |
| sidekiq.yml | 4 years ago | |
| storage.yml | 4 years ago | |
| themes.yml | 7 years ago | |
| webpacker.yml | 6 years ago | |