{"action":"created","issue":{"url":"https://api.github.com/repos/octobercms/october/issues/2521","repository_url":"https://api.github.com/repos/octobercms/october","labels_url":"https://api.github.com/repos/octobercms/october/issues/2521/labels{/name}","comments_url":"https://api.github.com/repos/octobercms/october/issues/2521/comments","events_url":"https://api.github.com/repos/octobercms/october/issues/2521/events","html_url":"https://github.com/octobercms/october/issues/2521","id":192501264,"number":2521,"title":"Backend user session cookie can be used to gain access, even if user has logged out","user":{"login":"arikw","id":7900646,"avatar_url":"https://avatars.githubusercontent.com/u/7900646?v=3","gravatar_id":"","url":"https://api.github.com/users/arikw","html_url":"https://github.com/arikw","followers_url":"https://api.github.com/users/arikw/followers","following_url":"https://api.github.com/users/arikw/following{/other_user}","gists_url":"https://api.github.com/users/arikw/gists{/gist_id}","starred_url":"https://api.github.com/users/arikw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arikw/subscriptions","organizations_url":"https://api.github.com/users/arikw/orgs","repos_url":"https://api.github.com/users/arikw/repos","events_url":"https://api.github.com/users/arikw/events{/privacy}","received_events_url":"https://api.github.com/users/arikw/received_events","type":"User","site_admin":false},"labels":[{"id":330616042,"url":"https://api.github.com/repos/octobercms/october/labels/Priority:%20High","name":"Priority: High","color":"eb6420","default":false},{"id":330615026,"url":"https://api.github.com/repos/octobercms/october/labels/Status:%20Completed","name":"Status: Completed","color":"006b75","default":false},{"id":67885479,"url":"https://api.github.com/repos/octobercms/october/labels/Type:%20Bug","name":"Type: Bug","color":"e11d21","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-30T08:12:45Z","updated_at":"2016-11-30T21:37:07Z","closed_at":"2016-11-30T21:37:07Z","body":"I logged out from a logged-in backend user account and expected that if the user's cookie, prior to the logout, is somehow available, it will be unusable for making authenticated calls.\r\nI've noticed that I can get logged in again, using the old cookie data.\r\n\r\nI would expect that for security reasons the old cookie data would be useless, if the user has logged out."},"comment":{"url":"https://api.github.com/repos/octobercms/october/issues/comments/264003277","html_url":"https://github.com/octobercms/october/issues/2521#issuecomment-264003277","issue_url":"https://api.github.com/repos/octobercms/october/issues/2521","id":264003277,"user":{"login":"daftspunk","id":1392869,"avatar_url":"https://avatars.githubusercontent.com/u/1392869?v=3","gravatar_id":"","url":"https://api.github.com/users/daftspunk","html_url":"https://github.com/daftspunk","followers_url":"https://api.github.com/users/daftspunk/followers","following_url":"https://api.github.com/users/daftspunk/following{/other_user}","gists_url":"https://api.github.com/users/daftspunk/gists{/gist_id}","starred_url":"https://api.github.com/users/daftspunk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daftspunk/subscriptions","organizations_url":"https://api.github.com/users/daftspunk/orgs","repos_url":"https://api.github.com/users/daftspunk/repos","events_url":"https://api.github.com/users/daftspunk/events{/privacy}","received_events_url":"https://api.github.com/users/daftspunk/received_events","type":"User","site_admin":false},"created_at":"2016-11-30T21:37:07Z","updated_at":"2016-11-30T21:37:07Z","body":"Had assumed this was the behavior all along, apparently not. Thanks for pointing this out!"}}
{"actor":{"display_login":"daftspunk"}}