-
Notifications
You must be signed in to change notification settings - Fork 666
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HTTPCreds: remove all cookies when logging out #5383
Conversation
Some custom server use persistent cookies with the auth token. So we should clear all the cookies when disconnecting. Account::clearCookieJar is only called from the HTTPCredentials. This funciton is not used for shibboleth. There is probably no reasons to keep the HTTP cookie anyway. Issue #5370
@ogoffart, thanks for your PR! By analyzing the history of the files in this pull request, we identified @jturcotte, @danimo and @ckamm to be potential reviewers. |
HTTP basic auth. working like a charm now. Have to try a couple more scenarios, but seems to be all right. Once it's done, should we cherrypick this into https://github.com/owncloud/client/releases/tag/v2.2.4 ?. cc/ @michaelstingl |
Leaving here a corner case due to the same account being able to log in multiple times in the same client (#5305) Actual behavior:Both cookies are wiped as they refer to the same username@domain combination. Expected behavior:The cookies could be wiped based on which was logged out and which wasn't Steps to reproduce:
As said, this is a corner case, don't know how relevant. |
@SamuAlfageme From my perspective, same account logged in multiple times, should be out of scope. (but there are other opinions) |
@owncloud/desktop-developers this is ready to be merged & cherrypicked to v2.2.4 tag, anyone? |
@SamuAlfageme 2.2.4 is already released and tags can't be changed. Was there a decision to do a 2.2.5 for this? |
@guruz I need a patch that would work on the 2.2.4 tag. No 2.2.5 required. |
@michaelstingl https://gist.github.com/guruz/f81cbc4cbcc499f9a87ee74f1fc9e86b (haven't tested it on 2.2.4 though but it should work) |
@SamuAlfageme Could you test-drive https://gist.github.com/guruz/f81cbc4cbcc499f9a87ee74f1fc9e86b and give a 👍 if it could be applied to 2.2.x? |
After struggling a bit because of some unrelated issues to test the patch over 2.2.4, finally did in both Win7 and OS X, and it's working as expected 🎉 Couple of concerns though:
cc/ @michaelstingl |
Some custom server use persistent cookies with the auth token. So we should
clear all the cookies when disconnecting.
Account::clearCookieJar is only called from the HTTPCredentials. This funciton
is not used for shibboleth.
There is probably no reasons to keep the HTTP cookie anyway.
Issue #5370