Fix session token creation "remember" parameter#51
Conversation
…rd by the Session class Signed-off-by: Julien Veyssier <[email protected]>
julien-nc
requested review from
ArtificialOwl,
blizzz,
juliusknorr and
schiessle
|
Maybe I'm confused. But we have two different flags for tokens. Temporary/permanent and remember-me. Temporary/permanent lets us distinguish between browser sessions (temporary token that expires) and app passwords (they don't expire). The remember/do-not-remember flag is only used for session tokens. We default to So I'm wondering if nextcloud/server#24552 was possibly wrong. I think we should set the app_password session var when (there is no |
Sounds right to only set the session value when using a permanent token. Tough I'd still think that using a remember me token might be expected behaviour (as with a regular login) also when logging in through the global site selector. |
|
@ChristophWurst Do you agree with @juliushaertl 's comment? I mean, does it still make sense to create a remember_me token when logging in via the GSS even if we fix Here is a PR for what you suggested: nextcloud/server#29729 |
delete-merged-branch
bot
deleted the
fix/noid/slave-login-remember-session-token
branch
* Create app passwords: [Ticket#9623982] nextcloud/globalsiteselector#51 * Create email templates using variables set in config.php: https://github.com/SUNET/drive-email-template * Add custom button on direct login page: https://github.com/SUNET/loginpagebutton/
|
/backport to stable1 |
3 participants
When the slave controller creates the session token on login, the
rememberparameter is set toIToken::DO_NOT_REMEMBER.This has a visible negative side effect: It is impossible to create an app password (in the web UI) after having logged in via GSS because
OC\User\Sessionbecauseapp_passwordis set in the session in this case.https://github.com/nextcloud/server/blob/582234322a59e32fd0d220023a260b66a9b205f2/lib/private/User/Session.php#L850-L854
As it is expected to prevent app password creation when authenticated with an app password, I think it should be possible when logging in via GSS.
I don't know if this is an acceptable fix and if it has bad side effects but it solves the app password generation issue.