Add plug to handle invalidated Pow session tokens #36
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I'm waiting with this one till there are no longer any bug reports with sessions being entirely lost (they may be lost temporarily but upon reload should work again). Otherwise this will obscure underlying issues. |
danschultzer
force-pushed
the
reuse-invalidated-pow-tokens
branch
from
ec86a01
to
f6c165b
Compare
Merged
Bonsly24
pushed a commit
to Bonsly24/philomena
that referenced
this pull request
Apr 12, 2023
Allow Philomena to read config from environment variables
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Exploring a potential resolution to pow-auth/pow#356 here.
The above issue exposed a variety of issues that I've squashed in Pow. The last one I can identify is not a technical issue in Pow, rather it's UX. The problem occurs if I let the session expire, and then open a bunch of tabs at the same time. The first request will successfully use the persistent session token, while all subsequent requests will fail since they use the old cookie value. Thus I've one tab where I'm authenticated, and the rest are not.
This PR adds a plug that stores a session id or persistent session token when they are rolled. If a request is unauthenticated and a session id or persistent session token exists in the request, the token will be looked up in the invalidated session cache. The tokens are only stored for 60 seconds (should probably be much less).
Though there is no test suite, I added the test for the plug for good measure. I'll comment on pow-auth/pow#356 to go more in depth regarding this approach, and conclusions.
I've tested this locally, and can no longer trigger the issue.
Before I commit to this, I want to explore if some upstream changes could make this easier, and I need to ensure that new sessions can't be created to prevent vulnerability.