search

chesio / bc-security

Helps keeping WordPress websites secure.
The Unlicense
14 stars 3 forks source link

Remove "Check auth cookies" setting #124

Closed chesio closed 2 years ago

chesio commented 2 years ago

Motivation:

  1. I'm not aware of any scenario where this feature should be off, so authentication cookies should be always checked.
  2. Optionality of the check allows for a subtle bug to be present - if the cookies are not checked, adding IP address on blacklist with admin scope does not prevent access to backend from this IP address if user is already logged.
chesio commented 2 years ago

Fixed in 9ecef2bdb12b1760d82211bd7523eab9bc51b326.