Log in with username/password: lyceum/lyceum

Ticket #885 (new defect)

Opened 8 months ago

Last modified 8 months ago

token system considerations

Reported by: jjb Assigned to:
Priority: normal Milestone: 1.1
Keywords: Cc:

Description

In [1271], I made tokens no longer be single-use, but also made sessions expire after 2 weeks.

This is not a sufficient final solution, because a token created a few minutes before a session's 2-week expiration time, will then immediately expire. Even with year-long sessions, this would be a problem.

Ideally, tokens from old sessions would last for x amount of time, but a new session would have to be created in order for a new token to be crated.

But since the security system is tied to authentication anyway-- that's still the missing link. So really, we should probably just have infinite sessions (login in lyceum/wordpress is infinite) until logout.

i'll sleep on it.

see ticket:729

Change History

11/24/07 03:22:40 changed by jjb

  • milestone changed from 1.0.3 to 1.0.2.

11/24/07 16:37:49 changed by jjb

  • milestone changed from 1.0.2 to 1.0.3.

See extensive notes in [1273].

All problems regarding sessions and user data from #729 should now be fixed. But a new problem has been created: session data staying around even when it is no longer used. Even when a user logs out and the session is destroyed, a garbage collection pass is not triggered, and the session data files are kept around.

More investigation needs to be done into best way to clean up unused session data.

The problems are fixed, but more work needs to be done, so moving this to another milestone.

11/24/07 19:05:16 changed by jjb

  • milestone changed from 1.0.3 to 1.1.

Okay, it looks like all the data is in fact getting properly cleared out, but the session files themselves are hanging around. This is annoying but won't really put a big strain on system resources except for in extraordinary circumstances, so moving this ahead.

Log in with username/password: lyceum/lyceum