flushing session on auth.logout

[sorl]

Flushing the session on logout or logging in with another user before logging the other user out will empty the session for all other applications using session data obviously. Should "Logout" in the admin really mean "completely erase all my session data for this site."? What if other applications acted this way, flushing the session data whenever it did not need it anymore.

[Mathieu Agopian <mathieu.agopian@…>]

Hello sorl,

I thought i could just add a specific use case that could possibly problematic, for further discussion.

When user A logs in, a warning message is displayed about some upcoming website maintenance. Once the user acknowledges this message, it stores SESSION['msg_read'] = True.

When user B logs in, if SESSION['msg_read'] isn't flushed, the warning message won't display.

I know the msg_read key could be flushed manually by registering to the user_logged_in or user_logged_out signals, i'm just not sure the responsability should be given to the developer in cases where there's potentially private/sensitive data that could leak from a user to another.

What about a way to specify in the settings if we specifically don't want to flush the whole session, but just the SESSION_KEY and BACKEND_SESSION_KEY ?
This way, by default, the current (safe) implementation would be used.

Set this ticket as "design decision needed" ?

[sorl]

@Mathieu Agopian
I can't make any sence from that use case, session data is not a global object and does not leak unless you hijack the other users session id.

[anonymous]

Replying to sorl:

@Mathieu Agopian
I can't make any sence from that use case, session data is not a global object and does not leak unless you hijack the other users session id.

Yes it does leak, think of computers where more than one user uses the same browsersession (Those still exists, especially @home if the users share the same username etc…)

[sorl]

I am confused, we should support users sharing session ids?

[Florian Apolloner]

Replying to sorl:

I am confused, we should support users sharing session ids?

Not necessarily, but it can happen; Better be safe than sorry. (Eg for instance, I do use a "trusted" friend's laptop if I forget mine to check something; of course I use his browser then…).

[sorl]

So this means the auth app should take care of cleaning session data for all other applications on logging out whether they like it or not. That can't be right?

[Florian Apolloner]

Putting into DDN, although it should be wontfix imo.

[Chris Beaven]

It's tight coupling between auth and session, but it's by design. I'm going to close this - but if you feel strongly sorl then bring it up on django-dev.

(the slightly wonky side discussion of 'what if the session is used in multiple places' did nothing to sway me in this direction)