Skip to content

Move to CSRF tokens inside sessions (instead of expiring cookies) #305

Open
@domino14

Description

@domino14

Several users have reported being unable to play any challenges (they get the JSON unexpected etc message). They all reported it around the same time, and logging out/in fixes it. Weirdly it seems they're still logged in, so I'm not sure what exactly it is.

Activity

self-assigned this
on Jan 23, 2019
domino14

domino14 commented on Jan 25, 2019

@domino14
OwnerAuthor

This is a CSRF token issue. If you log in twice it changes the tokens in the old session.

domino14

domino14 commented on Jan 29, 2019

@domino14
OwnerAuthor

Added logging to try to figure out why my csrf tokens are getting corrupted/disappearing #306

domino14

domino14 commented on Feb 4, 2019

@domino14
OwnerAuthor

closing because better error messaging. still should keep an eye on it. hopefully people aren't getting their tokens messed up all the time.

changed the title [-]Possible session bug[/-] [+]Move to CSRF tokens inside sessions (instead of expiring cookies)[/+] on Jan 1, 2022
domino14

domino14 commented on Jan 1, 2022

@domino14
OwnerAuthor

this still happens a lot. People's CSRF cookies just disappear. They are probably expiring.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Projects

No projects

Milestone

No milestone

Relationships

None yet

    Development

    No branches or pull requests

      Participants

      @domino14

      Issue actions

        Move to CSRF tokens inside sessions (instead of expiring cookies) · Issue #305 · domino14/Webolith