restapi - logout does not remove session id from tblSessions
Open Source Document Management System
Brought to you by:
steinm
Menu
▾
▴
#558 restapi - logout does not remove session id from tblSessions
Hi Uwe
One more issue I encountered. I am not 100% sure if this is a defect or not ...
While testing the restapi functionality with basic authentication using login and logout and use the session id as cookie, I noticed that I could use the same session id over and over again even though I executed the logout API call a couple time before. I checked the tblSessions and it was full of session ids which I created of testing. I checked the implementation of doLogout and I couldn't find use of $session->delete ... Wondering if this was the intent here or if this is just missing.
Btw, still using 6.0.25 from your docker package on hub.docker.com.
It doesn't really matter for me at the moment because I am using the header authentication via the API key which works well, but wanted to let you know.
Let me know what you think.
Thanks,
Christian
Your are right. The expiration date of the cookie was set in the past, but the session was not removed from the database. This will be fixed in 5.1.33 and 6.0.26. Many thanks for reporting this.