x/web-app-template
Archived
Template
2
0
Fork 0
Code Issues 13 Pull Requests 4 Actions Packages Activity

Invalidate old sessions/use new sessions after privilege changes #322

New Issue
Closed
opened 2024-12-15 22:40:16 +00:00 by tim · 1 comment
tim commented 2024-12-15 22:40:16 +00:00
Owner
Copy Link
  • SignUp
    • Invalidate old anonymous session
    • Create new session (sign up does not sign in)
  • SignIn
    • Invalidate old anonymous session
    • create new session
    • Invalid other old sessions (expires_at has been reached)
  • SignOut
    • Invalidate only the current session
  • Password Change
    • Invalidate all sessions except the current
  • Forgot Password
    • Invalidate all sessions

All these actions have to invalidate the previous session Id

See https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#renew-the-session-id-after-any-privilege-level-change

* SignUp * ~~Invalidate old anonymous session~~ * ~~Create new session~~ (sign up does not sign in) * SignIn * Invalidate old anonymous session * create new session * Invalid other old sessions (expires_at has been reached) * SignOut * Invalidate only the current session * Password Change * Invalidate all sessions except the current * Forgot Password * Invalidate all sessions All these actions have to invalidate the previous session Id See https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#renew-the-session-id-after-any-privilege-level-change
tim added this to the security milestone 2024-12-15 22:40:16 +00:00
tim commented 2024-12-18 22:51:36 +00:00
Author
Owner
Copy Link

Duplicate of #328

Duplicate of #328
tim changed title from Invalidate sessions after events to Invalidate old sessions/use new sessions after privilege changes 2024-12-18 22:53:04 +00:00
tim closed this issue 2024-12-31 10:54:19 +00:00
This repo is archived. You cannot comment on issues.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
blocker
fun
medium
minor
No Label
Milestone
No items
No Milestone security
Assignees
Clear assignees
renovate tim
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: x/web-app-template#322
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?