Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not clear CSRF token on logout (fix for #1303) #3832

Merged
merged 1 commit into from
Mar 30, 2017
Merged

Do not clear CSRF token on logout (fix for #1303) #3832

merged 1 commit into from
Mar 30, 2017

Commits on Mar 13, 2017

  1. Do not clear CSRF token on logout (fix for #1303) 

    This is a hacky way to allow the use case of #1303.

What happens is

1. User tries to login
2. PreLoginHook kicks in and figures out that the user need to change
their LDAP password or whatever => redirects user
3. While loading the redirect some logic of ours kicks in and logouts
the user (thus clearing the session).
4. We render the new page but now the session and the page disagree
about the CSRF token

This is kind of hacky but I don't think it introduces new attack
vectors.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
    @rullzer
    rullzer committed Mar 13, 2017
    Configuration menu
    Copy the full SHA
    bb94b39 View commit details
    Browse the repository at this point in the history