This repository has been archived on 2023-08-20. You can view files and clone it, but cannot push or open issues or pull requests.

Fabien Potencier 901d1de344 bug #13048 [Security] Delete old session on auth strategy migrate (xelaris) ... This PR was merged into the 2.3 branch. Discussion ---------- [Security] Delete old session on auth strategy migrate | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #13026 | License | MIT | Doc PR | As identified by @austinh in #13026 there are two sessions after authentication, since the previous session is migrated to a new one by ``session_regenerate_id``. This PR ensures the old session is been deleted immediately on migration. I can't see any drawbacks, but if the change would break BC, another approach would be to add a new strategy like ``switch`` to enable instant deletion of the old session. Commits ------- 5dd11e6 [Security] Delete old session on auth strategy migrate		2014-12-20 13:20:33 +01:00
..
Bridge	[Tests] Silenced all deprecations in tests for 2.3	2014-12-18 20:00:19 +01:00
Bundle	minor #13033 [Tests] Silenced all deprecations in tests for 2.3 (saro0h)	2014-12-20 10:04:46 +01:00
Component	bug #13048 [Security] Delete old session on auth strategy migrate (xelaris)	2014-12-20 13:20:33 +01:00