tf_validity_cookie not deleted on logout

pallets-eco / flask-security

Quick and simple security for Flask applications

MIT License

635 stars 155 forks source link

tf_validity_cookie not deleted on logout #822

Closed jwag956 closed 1 year ago

jwag956 commented 1 year ago

The new-ish tf_validity cookie, which is set upon successful two-factor authentication - isn't deleted on an explicit logout - which both the session and remember cookie are. This seems like a security concern.

@baurt - any comments?

jwag956 commented 1 year ago

Ok - never mind - I re-read OWASP and it does imply this should outlast a logout....