{"action":"created","issue":{"url":"https://api.github.com/repos/fengsp/flask-session/issues/27","repository_url":"https://api.github.com/repos/fengsp/flask-session","labels_url":"https://api.github.com/repos/fengsp/flask-session/issues/27/labels{/name}","comments_url":"https://api.github.com/repos/fengsp/flask-session/issues/27/comments","events_url":"https://api.github.com/repos/fengsp/flask-session/issues/27/events","html_url":"https://github.com/fengsp/flask-session/pull/27","id":114343800,"number":27,"title":"Added session destruction and regeneration support","user":{"login":"twolfson","id":902488,"avatar_url":"https://avatars.githubusercontent.com/u/902488?v=3","gravatar_id":"","url":"https://api.github.com/users/twolfson","html_url":"https://github.com/twolfson","followers_url":"https://api.github.com/users/twolfson/followers","following_url":"https://api.github.com/users/twolfson/following{/other_user}","gists_url":"https://api.github.com/users/twolfson/gists{/gist_id}","starred_url":"https://api.github.com/users/twolfson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/twolfson/subscriptions","organizations_url":"https://api.github.com/users/twolfson/orgs","repos_url":"https://api.github.com/users/twolfson/repos","events_url":"https://api.github.com/users/twolfson/events{/privacy}","received_events_url":"https://api.github.com/users/twolfson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-10-30T19:48:47Z","updated_at":"2016-03-12T06:35:42Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/fengsp/flask-session/pulls/27","html_url":"https://github.com/fengsp/flask-session/pull/27","diff_url":"https://github.com/fengsp/flask-session/pull/27.diff","patch_url":"https://github.com/fengsp/flask-session/pull/27.patch"},"body":"While working with `flask-session`, we realized we wanted to prevent session fixation attacks. These are attacks which involve a user's session id not being rotated on login nor fully erased on logout. In order to remedy that, we are adding 2 methods:\r\n\r\n- `session_interface.destroy` - Erases underlying store data and deletes user cookie (used during logout)\r\n- `session_interface.regenerate` - Generates a new session id and deletes old store data (used during login)\r\n\r\nIn this PR:\r\n\r\n- Added tests for destroy behavior (old behavior of setting `flask.session` to `None` or `{}` wasn't working since `_permanent` was being held)\r\n- Added tests for regenerate behavior\r\n- Added `session_interface.destroy` and `session_interface.regenerate`\r\n\r\n**Notes:** It's not clear whether this should live in `flask` or `flask-session` but this was definitely the simpler solution for now. I will be opening a sibling issue on `flask` to get feedback."},"comment":{"url":"https://api.github.com/repos/fengsp/flask-session/issues/comments/195670966","html_url":"https://github.com/fengsp/flask-session/pull/27#issuecomment-195670966","issue_url":"https://api.github.com/repos/fengsp/flask-session/issues/27","id":195670966,"user":{"login":"kgritesh","id":3336623,"avatar_url":"https://avatars.githubusercontent.com/u/3336623?v=3","gravatar_id":"","url":"https://api.github.com/users/kgritesh","html_url":"https://github.com/kgritesh","followers_url":"https://api.github.com/users/kgritesh/followers","following_url":"https://api.github.com/users/kgritesh/following{/other_user}","gists_url":"https://api.github.com/users/kgritesh/gists{/gist_id}","starred_url":"https://api.github.com/users/kgritesh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kgritesh/subscriptions","organizations_url":"https://api.github.com/users/kgritesh/orgs","repos_url":"https://api.github.com/users/kgritesh/repos","events_url":"https://api.github.com/users/kgritesh/events{/privacy}","received_events_url":"https://api.github.com/users/kgritesh/received_events","type":"User","site_admin":false},"created_at":"2016-03-12T06:35:42Z","updated_at":"2016-03-12T06:35:42Z","body":"Wanted to know if there is any update on this as well"}}