3 ms·
Pretty sure this can be fixed with a timestamp in the session data. You can either expire the timestamp by time or by keeping a datetime field on the user and u
by epochwolf 13y ago
Pretty sure this can be fixed with a timestamp in the session data. You can either expire the timestamp by time or by keeping a datetime field on the user and updating the timestamp after a password change. Or you can use a combination of these two.
This is not a new issue. It is a well known limitation of the cookie store. I've been working around this with timestamps for years.
- thibaut_barrere 13y agoCan you share maybe the code you're using to do that? As well: rotating the secret token every night could probably be used to discard all existing cookies, right? (although this is a bit brute force and will kick out anyone currently using the app).
- epochwolf 13y agoNope. The last version I wrote is buried in a rails app at a company I no longer work for. It's a three or four line before filter in the application controller. I reimplement it every time since it's relatively simple. I don't have it on any public code since it's also the last thing I implement before launching.