[Security] Log out only deletes browser cookies

[ghost]

• Gitea version (or commit ref): all
• Git version: not relevant
• Operating system: not relevant
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

Screenshots

[axifive]

@cezar97, Thank you for the Gitea security research, this is extremely important for the further successful development of the project.
I eventually reproduced this problem. It was necessary to log in with clicked Remember Me checkbox. And after analysis the problem turned out to be more serious than it seemed.

[lafriks]

@cezar97 not to be picky but I did respond to your reports. It just that we all (including Gitea Team) here are voluntary developers working in their free time so not everything can be done so fast as we would like. We still have to do our daily work to get money :) Anyway we are thinking on way to get word out about reported security issues to more Gitea maintainers