- avoid removing session for cookie auth if LoginCookieDeleteAll is
disabled
- redirect user to other server rather than to login page
- show message about partial logout
- adjust tests
- this is based on #13221Fixes#12301
Signed-off-by: Michal Čihař <michal@cihar.com>
If you are logged-in into multiple database servers, logOut() logs you
out of all of them. This fix will prevent that, and will only destroy
the session when you log out of the last server.
Signed-off-by: Michal Čihař <michal@cihar.com>
Signed-off-by: Harro Verton <wanwizard@wanwizard.eu>
Calculate session expiry per browser (tracking is based on
sessionStorage which is unique per tab). With this we're able to detect
that there is another window open and actively used and avoid logging it
out by inactive one.
Issue #11231
Signed-off-by: Michal Čihař <michal@cihar.com>
We need to ansure the access_time parameter is in valid range to avoid
possibility of remotely extending session validity.
Signed-off-by: Michal Čihař <michal@cihar.com>
- add separate script for handling logout
- no longer require old_usr for all authentication methods
(this avoids potential information leak)
- require valid token for logout
Signed-off-by: Michal Čihař <michal@cihar.com>
