Calculate session expiry per browser (tracking is based on
sessionStorage which is unique per tab). With this we're able to detect
that there is another window open and actively used and avoid logging it
out by inactive one.
Issue #11231
Signed-off-by: Michal Čihař <michal@cihar.com>
We need to ansure the access_time parameter is in valid range to avoid
possibility of remotely extending session validity.
Signed-off-by: Michal Čihař <michal@cihar.com>
- add separate script for handling logout
- no longer require old_usr for all authentication methods
(this avoids potential information leak)
- require valid token for logout
Signed-off-by: Michal Čihař <michal@cihar.com>
