mirror of
https://we.phorge.it/source/phorge.git
synced 2024-12-29 08:50:58 +01:00
95eeffff7e
Summary: Fixes T5509. Currently, existing sessions live on even if you change your password. Over the course of the program, we've recieved a lot of HackerOne reports that sessions do not terminate when users change their passwords. I hold that this isn't a security vulnerability: users can explicitly manage sessions, and this is more general and more powerful than tying session termination to password resets. In particular, many installs do not use a password provider at all (and no researcher has reported this in a general, application-aware way that discusses multiple authentication providers). That said, dealing with these false positives is vaguely time consuming, and the "expected" behavior isn't bad for users, so just align behavior with researcher expectations: when passwords are changed, providers are removed, or multi-factor authentication is added to an account, terminate all other active login sessions. Test Plan: - Using two browsers, established multiple login sessions. - In one browser, changed account password. Saw session terminate and logout in the second browser. - In one browser, removed an authentication provider. Saw session terminate and logout in the second browser. - In one browser, added MFA. Saw session terminate and logout in the second browser. Reviewers: btrahan Reviewed By: btrahan Subscribers: epriestley Maniphest Tasks: T5509 Differential Revision: https://secure.phabricator.com/D10135 |
||
|---|---|---|
| .. | ||
| action | ||
| application | ||
| controller | ||
| panel | ||
| storage | ||