Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Authentication adapter did not verify validity of tokens #6

Closed
Ocramius opened this issue Apr 26, 2014 · 0 comments
Closed

Authentication adapter did not verify validity of tokens #6

Ocramius opened this issue Apr 26, 2014 · 0 comments
Labels
bug

Comments

@Ocramius
Copy link
Member

Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a (release 0.1.2), tokens weren't checked for validity/expiration.

This potentially caused a security issue if expired tokens were not deleted after the expiration time was past, allowing anyone to still use invalidated authentication credentials.
Ocramius added a commit to Ocramius/security-advisories that referenced this issue Apr 26, 2014
@Ocramius
Adding security advisory about zf-fr/zfr-oauth2-server-module#6
2f8cccf
@Ocramius Ocramius mentioned this issue Apr 26, 2014
Merged
@Ocramius Ocramius added bug and removed enhancement labels Apr 26, 2014
fabpot added a commit to FriendsOfPHP/security-advisories that referenced this issue Apr 27, 2014
@fabpot
Merge pull request #19 from Ocramius/advisories/zf-fr-zfr-oauth2-serv…
938b9d2 
…er-module-2014-04-26

Adding security advisory about zf-fr/zfr-oauth2-server-module#6
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@Ocramius