You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Claire 6da135a493 Fix reviving revoked sessions and invalidating login (#16943) ... Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from *all* logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for *all* browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues.		4 years ago
..
0_post_deployment_migrations.rb	…
1_hosts.rb	Fix host check on healthcheck path not being disabled (#16270)	5 years ago
2_whitelist_mode.rb	…
active_model_serializers.rb	…
application_controller_renderer.rb	…
assets.rb	…
backtrace_silencers.rb	…
blacklists.rb	…
cache_buster.rb	…
chewy.rb	Support authentication for ElasticSearch (#16890)	4 years ago
content_security_policy.rb	Fix autoloading deprecation warnings from Rails 6 (#16010)	5 years ago
cookies_serializer.rb	…
cors.rb	…
devise.rb	Fix reviving revoked sessions and invalidating login (#16943)	4 years ago
doorkeeper.rb	Fix app name, website and redirect URIs not having a maximum length (#16042)	5 years ago
fast_blank.rb	…
ffmpeg.rb	…
filter_parameter_logging.rb	…
http_client_proxy.rb	…
httplog.rb	…
inflections.rb	…
json_ld.rb	…
kaminari_config.rb	…
mail_delivery_job.rb	Fix mailer jobs for deleted notifications erroring out (#16294)	5 years ago
makara.rb	…
mime_types.rb	…
oj.rb	…
omniauth.rb	New env variable: CAS_SECURITY_ASSUME_EMAIL_IS_VERIFIED (#16655)	4 years ago
open_uri_redirection.rb	…
paperclip.rb	Fix autoloading deprecation warnings from Rails 6 (#16010)	5 years ago
permissions_policy.rb	…
preload_link_headers.rb	…
premailer_rails.rb	…
rack_attack.rb	…
rack_attack_logging.rb	…
redis.rb	…
session_activations.rb	…
session_store.rb	Add Ruby 3.0 support (#16046)	5 years ago
sidekiq.rb	Add a Redis environment variable for sidekiq (#16188)	5 years ago
simple_form.rb	…
single_user_mode.rb	…
statsd.rb	…
stoplight.rb	…
strong_migrations.rb	…
suppress_csrf_warnings.rb	Fix autoloading deprecation warnings from Rails 6 (#16010)	5 years ago
trusted_proxies.rb	…
twitter_regex.rb	Minor memory optimizations (#16507)	4 years ago
vapid.rb	…
webauthn.rb	…
wrap_parameters.rb	…