diff options
| author | Olivier Dony <odo@odoo.com> | 2018-10-02 01:00:37 +0200 |
|---|---|---|
| committer | Olivier Dony <odo@odoo.com> | 2018-10-02 01:00:37 +0200 |
| commit | 9bae56acd4ebe2b169ef635892b2cd9b6664a9d0 (patch) | |
| tree | 7d070c465a7f57b30e590f96ab0aa67fb669ecc4 /doc | |
| parent | c47600887f8065365def44f3f8e85e9eff6f6d4b (diff) | |
[IMP] http: reinstate session rotation after login
Session rotation was introduced a long time ago, but deactivated at
login due to obscure side-effects related to #6949 (aka the "BBQ" PR).
This commit reinstates the rotation, which is better from a security
standpoint.
In order to also prevent session ID reuse, we force the renewal of
deleted sessions, at the SessionStore level (via `renew_missing`).
Diffstat (limited to 'doc')
0 files changed, 0 insertions, 0 deletions