mirror of https://github.com/mastodon/mastodon
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
6da135a493
Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from *all* logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for *all* browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues. |
4 years ago | |
|---|---|---|
| .. | ||
| account_suggestions | 5 years ago | |
| admin | 4 years ago | |
| concerns | 4 years ago | |
| form | 4 years ago | |
| web | 5 years ago | |
| account.rb | 4 years ago | |
| account_alias.rb | 5 years ago | |
| account_conversation.rb | 5 years ago | |
| account_deletion_request.rb | 5 years ago | |
| account_domain_block.rb | ||
| account_filter.rb | 5 years ago | |
| account_identity_proof.rb | ||
| account_migration.rb | 5 years ago | |
| account_moderation_note.rb | ||
| account_note.rb | 4 years ago | |
| account_pin.rb | ||
| account_stat.rb | 4 years ago | |
| account_statuses_cleanup_policy.rb | 4 years ago | |
| account_suggestions.rb | 5 years ago | |
| account_summary.rb | 5 years ago | |
| account_warning.rb | 5 years ago | |
| account_warning_preset.rb | ||
| admin.rb | ||
| announcement.rb | 5 years ago | |
| announcement_filter.rb | ||
| announcement_mute.rb | ||
| announcement_reaction.rb | ||
| application_record.rb | ||
| backup.rb | ||
| block.rb | ||
| bookmark.rb | 4 years ago | |
| canonical_email_block.rb | 5 years ago | |
| context.rb | ||
| conversation.rb | ||
| conversation_mute.rb | ||
| custom_emoji.rb | 4 years ago | |
| custom_emoji_category.rb | ||
| custom_emoji_filter.rb | ||
| custom_filter.rb | 5 years ago | |
| device.rb | ||
| domain_allow.rb | 5 years ago | |
| domain_block.rb | 5 years ago | |
| email_domain_block.rb | ||
| encrypted_message.rb | 5 years ago | |
| export.rb | 5 years ago | |
| favourite.rb | 4 years ago | |
| featured_tag.rb | ||
| feed.rb | 5 years ago | |
| follow.rb | 5 years ago | |
| follow_recommendation.rb | 5 years ago | |
| follow_recommendation_filter.rb | 5 years ago | |
| follow_recommendation_suppression.rb | 5 years ago | |
| follow_request.rb | 5 years ago | |
| home_feed.rb | 5 years ago | |
| identity.rb | ||
| import.rb | 5 years ago | |
| instance.rb | 5 years ago | |
| instance_filter.rb | 5 years ago | |
| invite.rb | 5 years ago | |
| invite_filter.rb | ||
| ip_block.rb | 5 years ago | |
| list.rb | 5 years ago | |
| list_account.rb | ||
| list_feed.rb | 5 years ago | |
| login_activity.rb | 4 years ago | |
| marker.rb | ||
| media_attachment.rb | 4 years ago | |
| mention.rb | ||
| message_franking.rb | ||
| mute.rb | 5 years ago | |
| notification.rb | 5 years ago | |
| one_time_key.rb | ||
| poll.rb | 5 years ago | |
| poll_vote.rb | ||
| preview_card.rb | 4 years ago | |
| public_feed.rb | 5 years ago | |
| relationship_filter.rb | ||
| relay.rb | ||
| remote_follow.rb | 5 years ago | |
| report.rb | 5 years ago | |
| report_filter.rb | 4 years ago | |
| report_note.rb | ||
| rule.rb | 5 years ago | |
| scheduled_status.rb | ||
| search.rb | ||
| session_activation.rb | 5 years ago | |
| setting.rb | 5 years ago | |
| site_upload.rb | ||
| status.rb | 4 years ago | |
| status_pin.rb | 4 years ago | |
| status_stat.rb | ||
| system_key.rb | ||
| tag.rb | 5 years ago | |
| tag_feed.rb | 5 years ago | |
| tag_filter.rb | 5 years ago | |
| tombstone.rb | ||
| trending_tags.rb | 5 years ago | |
| unavailable_domain.rb | 5 years ago | |
| user.rb | 4 years ago | |
| user_invite_request.rb | ||
| web.rb | ||
| webauthn_credential.rb | 5 years ago | |