{"action":"created","issue":{"url":"https://api.github.com/repos/alphagov/digitalmarketplace-user-frontend/issues/54","repository_url":"https://api.github.com/repos/alphagov/digitalmarketplace-user-frontend","labels_url":"https://api.github.com/repos/alphagov/digitalmarketplace-user-frontend/issues/54/labels{/name}","comments_url":"https://api.github.com/repos/alphagov/digitalmarketplace-user-frontend/issues/54/comments","events_url":"https://api.github.com/repos/alphagov/digitalmarketplace-user-frontend/issues/54/events","html_url":"https://github.com/alphagov/digitalmarketplace-user-frontend/pull/54","id":309817659,"number":54,"title":"414 inadequate session termination","user":{"login":"katstevens","id":3492540,"avatar_url":"https://avatars3.githubusercontent.com/u/3492540?v=4","gravatar_id":"","url":"https://api.github.com/users/katstevens","html_url":"https://github.com/katstevens","followers_url":"https://api.github.com/users/katstevens/followers","following_url":"https://api.github.com/users/katstevens/following{/other_user}","gists_url":"https://api.github.com/users/katstevens/gists{/gist_id}","starred_url":"https://api.github.com/users/katstevens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/katstevens/subscriptions","organizations_url":"https://api.github.com/users/katstevens/orgs","repos_url":"https://api.github.com/users/katstevens/repos","events_url":"https://api.github.com/users/katstevens/events{/privacy}","received_events_url":"https://api.github.com/users/katstevens/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-03-29T16:16:28Z","updated_at":"2018-03-29T16:35:14Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/alphagov/digitalmarketplace-user-frontend/pulls/54","html_url":"https://github.com/alphagov/digitalmarketplace-user-frontend/pull/54","diff_url":"https://github.com/alphagov/digitalmarketplace-user-frontend/pull/54.diff","patch_url":"https://github.com/alphagov/digitalmarketplace-user-frontend/pull/54.patch"},"body":"Trello https://trello.com/c/NStzgIbd/414-inadequate-session-termination\r\n\r\nThe recent pen test highlighted that our sessions are not invalidated properly on logout. \r\n\r\nThis possible solution sets the session cookie's expiry to the Unix epoch (which one would hope is in the past). \r\n\r\nI'm not 100% sure this will be sufficient! It's also hard to test in-browser as a new session cookie is immediately set for the logged out user. \r\n\r\nThoughts/alternative suggestions welcome."},"comment":{"url":"https://api.github.com/repos/alphagov/digitalmarketplace-user-frontend/issues/comments/377294895","html_url":"https://github.com/alphagov/digitalmarketplace-user-frontend/pull/54#issuecomment-377294895","issue_url":"https://api.github.com/repos/alphagov/digitalmarketplace-user-frontend/issues/54","id":377294895,"user":{"login":"katstevens","id":3492540,"avatar_url":"https://avatars3.githubusercontent.com/u/3492540?v=4","gravatar_id":"","url":"https://api.github.com/users/katstevens","html_url":"https://github.com/katstevens","followers_url":"https://api.github.com/users/katstevens/followers","following_url":"https://api.github.com/users/katstevens/following{/other_user}","gists_url":"https://api.github.com/users/katstevens/gists{/gist_id}","starred_url":"https://api.github.com/users/katstevens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/katstevens/subscriptions","organizations_url":"https://api.github.com/users/katstevens/orgs","repos_url":"https://api.github.com/users/katstevens/repos","events_url":"https://api.github.com/users/katstevens/events{/privacy}","received_events_url":"https://api.github.com/users/katstevens/received_events","type":"User","site_admin":false},"created_at":"2018-03-29T16:35:14Z","updated_at":"2018-03-29T16:35:14Z","author_association":"CONTRIBUTOR","body":"Yeah... as discussed just now, I don't think we store the sessions server side (at least not anywhere I know about). [Flask-Session](https://pythonhosted.org/Flask-Session/) allows you to configure a DB table or Redis cache to store things. But it feels a bit nuts introducing a way of storing sessions just so we can delete them. "}}
{"actor":{"display_login":"katstevens"}}