search

dmeese / MathWorld

Team Bunny Slippers Math World Web Application
0 stars 1 forks source link

sessions don't timeout #12

Closed enasni closed 11 years ago

enasni commented 11 years ago

Once authenticated the user is issued a cookie with the session id. On page requests the cookie is checked, however the cookie persists for the duration that the browser is open or until the user manually logs out.

There should be a temporal component to the session to allow it to automatically time out after a period of time and force the user to re-authenticate.

CKinWoodstock commented 11 years ago

AGreed. Code added to timeout session after 15 minutes.

CKinWoodstock commented 11 years ago

enasni:

You have been awarded one bug bounty point for this issue.