Contrib.social

PL token won't start new session if old session expired from DB

Open on Drupal.org →
Created on 21 March 2023, over 1 year ago
Updated 23 March 2023, over 1 year ago

Problem/Motivation

The default services.yml will remove sessions from the database after 200000 seconds / ~2 days, which could occur while a user's cookie has not yet expired in the browser. Since TokenHandler checks for the existence of a session cookie to skip token validation, if the session handler doesn't remove the invalid session cookie from the request's cookie bag prior to TokenHandler acting, then PL will not initialize a new session for the user on that request (or until the request after the browser is told to remove the session cookie).

    # Set session lifetime (in seconds), i.e. the grace period for session
    # data. Sessions are deleted by the session garbage collector after one
    # session lifetime has elapsed since the user's last visit. When a session
    # is deleted, authenticated users are logged out, and the contents of the
    # user's session is discarded.
    # @default 200000
    gc_maxlifetime: 200000

Steps to reproduce

1. Log in with the "Remember Me" option
2. Delete sessions from the database
3. Visit a page on the site
Expected Behaviour: The PL token should be validated, and a new session started.
Current Behaviour: The PL token is not validated, and the page is loaded as an anonymous user. The response clears the session token, and refreshing the page will validate the PL token and login the user.

Proposed resolution

Replace the !$this->sessionConfiguration->hasSession($request) check in TokenHandler with one that actually checks that a valid session was initialized.

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Fixed

Version

1.0

Component

Code

Created by

🇨🇦Canada gapple

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024