Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Move to CSRF tokens inside sessions (instead of expiring cookies) #305

Open
domino14 opened this issue Jan 23, 2019 · 4 comments
Open

Move to CSRF tokens inside sessions (instead of expiring cookies) #305

domino14 opened this issue Jan 23, 2019 · 4 comments
Assignees
@domino14
Labels
bug high priority

Comments

@domino14
Copy link
Owner

Several users have reported being unable to play any challenges (they get the JSON unexpected etc message). They all reported it around the same time, and logging out/in fixes it. Weirdly it seems they're still logged in, so I'm not sure what exactly it is.
@domino14 domino14 self-assigned this Jan 23, 2019
@domino14
Copy link
Owner Author

This is a CSRF token issue. If you log in twice it changes the tokens in the old session.

@domino14
Copy link
Owner Author

Added logging to try to figure out why my csrf tokens are getting corrupted/disappearing #306

@domino14 domino14 closed this as completed Feb 4, 2019
@domino14
Copy link
Owner Author

domino14 commented Feb 4, 2019

closing because better error messaging. still should keep an eye on it. hopefully people aren't getting their tokens messed up all the time.

@domino14 domino14 reopened this Jan 1, 2022
@domino14 domino14 changed the title Possible session bug Move to CSRF tokens inside sessions (instead of expiring cookies) Jan 1, 2022
@domino14
Copy link
Owner Author

domino14 commented Jan 1, 2022

this still happens a lot. People's CSRF cookies just disappear. They are probably expiring.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@domino14 domino14

Labels
bug high priority
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@domino14