Closed dmcinnes closed 8 years ago
LGTM
@elight thanks!
@dmcinnes was this change driven by the security team? I'd be interested to know the history.
@paulelliott yes it was, as a result of pen testing: https://trello.com/c/EPEWhrbr/62-2015-pen-test-user-session-cross-over-api
This updates the login endpoint to force any previous sessions attached to the browser to explicitly log out before the new user logs in.
Also does the same for login-external requests.
Ready for review @heroku/api