It really doesn't make sense here as the username can potentionally
contain < anyway and we need to deal with it later (and we do).
Fixes#12710
Signed-off-by: Michal Čihař <michal@cihar.com>
We need to ansure the access_time parameter is in valid range to avoid
possibility of remotely extending session validity.
Signed-off-by: Michal Čihař <michal@cihar.com>
This makes the comparison happen in constant time and makes it
impossible to use it to guess stored usernames.
Signed-off-by: Michal Čihař <michal@cihar.com>
- add separate script for handling logout
- no longer require old_usr for all authentication methods
(this avoids potential information leak)
- require valid token for logout
Signed-off-by: Michal Čihař <michal@cihar.com>
This allows us to test the code without using runkit. Currenly only
AuthenticationHttp is migrated to new code, but others will follow.
Signed-off-by: Michal Čihař <michal@cihar.com>
