-
-
Notifications
You must be signed in to change notification settings - Fork 85
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Save session.id in cookie instead of user.id to allow expiration #44
Labels
Comments
This is breaking because it means signing out everyone after upgrading. Perhaps there's an easy enough upgrade path of fall back to looking up session with something like |
Consider that possibly breaking change then 😄 |
Closed by #53 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When we
authenticate_by_cookie
we find the user by the saveduser_id
in the cookies. This means we don't actually know when their session expires.Instead we'll save the session.id and look up the user from that. That way we'll know if the session has expired too. We might even want to check for this on every sign-in-required request?
The text was updated successfully, but these errors were encountered: