4 ms·
Another problem we saw (but didn't mentioned): You can't logout sessions on the server-side. If you forgot to logout somewhere, your session will stay valid. An
by nezza-_- 14y ago
Another problem we saw (but didn't mentioned):
You can't logout sessions on the server-side. If you forgot to logout somewhere, your session will stay valid. And an expiration-date for the sessions is optional. Neither changing your password nor contacting the site admins will help you.
- the_mitsuhiko 14y agoThat's not really true. You could easily add another piece of information to your session that is derived from something stored with the user (for instance a running counter). So if someone runs away with your session you add a button "logout everything" which increments the counter. When the session is accessed for the next time the counter values don't match and the user is logged out.