peter
02714e4986
A renewal answers with the session its request started with. Each session now carries an id; signing out, or signing in as someone else, revokes it (revoked_sessions, migration 0120), and a cookie carrying a revoked id is refused. A cookie from before session ids gets one drawn from the cookie itself. The race after log-out-everywhere fails closed and stays.
34 lines
1.2 KiB
Python
34 lines
1.2 KiB
Python
"""revoked_sessions: a signed-out browser session's id, so a cookie that lands after the sign-out is refused
|
|
|
|
Revision ID: 0120_revoked_sessions
|
|
Revises: 0119_plex_transcode_gpu
|
|
Create Date: 2026-11-14
|
|
|
|
The session slides: a request renews its cookie once a day. A request still in flight when the browser
|
|
signs out answers with the cookie it started with, and that cookie, landing after the sign-out cleared
|
|
it, signed the browser back in. Each session now carries an id (`sid`); signing out, or signing in as
|
|
someone else, stores the old id here, and `auth._session_user` refuses a cookie that carries one.
|
|
"""
|
|
|
|
import sqlalchemy as sa
|
|
from alembic import op
|
|
|
|
revision: str = "0120_revoked_sessions"
|
|
down_revision: str | None = "0119_plex_transcode_gpu"
|
|
branch_labels: str | None = None
|
|
depends_on: str | None = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.create_table(
|
|
"revoked_sessions",
|
|
sa.Column("sid", sa.String(32), primary_key=True),
|
|
sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=False),
|
|
)
|
|
op.create_index("ix_revoked_sessions_revoked_at", "revoked_sessions", ["revoked_at"])
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_index("ix_revoked_sessions_revoked_at", table_name="revoked_sessions")
|
|
op.drop_table("revoked_sessions")
|