DaanHoogland commented on issue #3625: ui allows disabled API call and then ends session URL: https://github.com/apache/cloudstack/issues/3625#issuecomment-557459252 @wido @rhtyd after analysing I think the session is invalidated to rigorously in the mentioned commits. Please consider: 1. if a valid user does a request they are not allowed, an error response must be given and the session maintained 2. if a user makes a request from a disallowed ip, the session must be aborted/invalidated 3. if an unauthenticated user makes a request the session should have not existed in the first place (and I think we have no issue here) the first .1 is old behaviour which no longer works. .2 is new behaviour that makes sense and should be preserved. If you agree I'll create a PR for this.
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
