[fixes #22] Per-user keyrings, session invalidation #26
Conversation
Generate a Keyring for each user id, this makes it possible to invalidate the keyring on logout, meaning other user sessions using the same authentication token will become invalid. This protects against session stealing (copying the __ac cookie) and creates a working server-side log-out.
|
@david-batranu thanks for creating this Pull Request and helping to improve Plone! TL;DR: Finish pushing changes, pass all other checks, then paste a comment: To ensure that these changes do not break other parts of Plone, the Plone test suite matrix needs to pass, but it takes 30-60 min. Other CI checks are usually much faster and the Plone Jenkins resources are limited, so when done pushing changes and all other checks pass either start all Jenkins PR jobs yourself, or simply add the comment above in this PR to start all the jobs automatically. Happy hacking! |
|
@jenkins-plone-org please run jobs |
|
Fixed issues found by Jenkins, added tests for the session invalidation on log-out and also made it optional, enabling/disabling can be done via the Would appreciate some feedback. |
ale-rt
left a comment
There was a problem hiding this comment.
This looks a nice new feature to me and I am fine to merge.
Thanks for your work!
I would wait for some opinion coming from the @plone/security-team before merging.
jensens
left a comment
There was a problem hiding this comment.
Overall a great feature. Like!
Just one minor complaint, see comment.
Tests now pass without IDisableCSRFProtection, unknown why.
mauritsvanrees
left a comment
There was a problem hiding this comment.
High time that we merge this. LGTM.
| @@ -0,0 +1 @@ | |||
| Creating per-user keyrings in order to have session invalidation on log-out (server-side logout). [david-batranu] No newline at end of file | |||
There was a problem hiding this comment.
Please remove the file .txt extension. it has to be just .feature to be properly picked up by towncrier.
| from zope.component import getUtility | ||
| from zope.component import queryUtility | ||
| from zope.interface import implementer | ||
| from zope.interface import alsoProvides |
There was a problem hiding this comment.
Now this imported can be removed, right?
|
I noticed I had a pending review on this... I will fix it myself as a punishment... |
|
I did that on #31 |
Generate a Keyring for each user id, this makes it possible to invalidate the keyring on logout, meaning other user sessions using the same authentication token will become invalid.
The change applies only to new sessions, existing sessions will still be able to validate with the
_secretkeyring.This protects against session stealing (copying the __ac cookie) and creates a working server-side log-out.
I require some input regarding: