Hey @mikker, I was going through the Rails' security guide and reading about the Session Fixation attack, it seems that Passwordless might be afftected by that as it never resets the session after the sign in (and only on the sign out)
I haven't double checked it, I only went through the current code and I wanted to let you know.
You could be right. I don't have the time for a deep dive right now, but it looks like the fix is just to add that reset_session upon sign in? A PR is very welcome!
Hey @mikker, I was going through the Rails' security guide and reading about the Session Fixation attack, it seems that Passwordless might be afftected by that as it never resets the session after the sign in (and only on the sign out)
I haven't double checked it, I only went through the current code and I wanted to let you know.