Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 97a7dab

Browse files
committed
Fixed #6941 -- When logging a user out, or when logging in with an existing
session and a different user id to the current session owner, flush the session data to avoid leakage. Logging in and moving from an anonymous user to a validated user still keeps existing session data. Backwards incompatible if you were assuming sessions persisted past logout. git-svn-id: http://code.djangoproject.com/svn/django/trunk@8343 bcc190cf-cafb-0310-a4f2-bffc1f526a37
1 parent 5e8efa9 commit 97a7dab

File tree

3 files changed

+21
-11
lines changed

3 files changed

+21
-11
lines changed

‎django/contrib/auth/__init__.py‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -53,23 +53,21 @@ def login(request, user):
5353
# TODO: It would be nice to support different login methods, like signed cookies.
5454
user.last_login = datetime.datetime.now()
5555
user.save()
56+
if request.session.get('SESSION_KEY', user.id) != user.id:
57+
# To avoid reusing another user's session, create a new, empty session
58+
# if the existing session corresponds to a different authenticated user.
59+
request.session.flush()
5660
request.session[SESSION_KEY] = user.id
5761
request.session[BACKEND_SESSION_KEY] = user.backend
5862
if hasattr(request, 'user'):
5963
request.user = user
6064

6165
def logout(request):
6266
"""
63-
Remove the authenticated user's ID from the request.
67+
Removes the authenticated user's ID from the request and flushes their
68+
session data.
6469
"""
65-
try:
66-
del request.session[SESSION_KEY]
67-
except KeyError:
68-
pass
69-
try:
70-
del request.session[BACKEND_SESSION_KEY]
71-
except KeyError:
72-
pass
70+
request.session.flush()
7371
if hasattr(request, 'user'):
7472
from django.contrib.auth.models import AnonymousUser
7573
request.user = AnonymousUser()

‎docs/authentication.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -426,6 +426,13 @@ use ``django.contrib.auth.logout()`` within your view. It takes an
426426

427427
Note that ``logout()`` doesn't throw any errors if the user wasn't logged in.
428428

429+
**New in Django development version:** When you call ``logout()``, the session
430+
data for the current request is completely cleaned out. All existing data is
431+
removed. This is to prevent another person from using the same web browser to
432+
log in and have access to the previous user's session data. If you want to put
433+
anything into the session that will be available to the user immediately after
434+
logging out, do that *after* calling ``django.contrib.auth.logout()``.
435+
429436
Limiting access to logged-in users
430437
----------------------------------
431438

‎docs/sessions.txt‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,8 +117,8 @@ It also has these methods:
117117
Delete the current session data from the database and regenerate the
118118
session key value that is sent back to the user in the cookie. This is
119119
used if you want to ensure that the previous session data can't be
120-
accessed again from the user's browser (for example, the standard
121-
``logout()`` method calls it).
120+
accessed again from the user's browser (for example, the
121+
``django.contrib.auth.logout()`` method calls it).
122122

123123
* ``set_test_cookie()``
124124

@@ -230,6 +230,11 @@ This simplistic view logs in a "member" of the site::
230230
pass
231231
return HttpResponse("You're logged out.")
232232

233+
The standard ``django.contrib.auth.logout()`` function actually does a bit
234+
more than this to prevent inadvertent data leakage. It calls
235+
``request.session.flush()``. We are using this example as a demonstration of
236+
how to work with session objects, not as a full ``logout()`` implementation.
237+
233238
Setting test cookies
234239
====================
235240

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /