#24799: Cookie-backed sessions fail to flush with a custom SESSION_COOKIE_DOMAIN
----------------------------------+--------------------
Reporter: pindia | Owner: nobody
Type: Bug | Status: new
Component: contrib.sessions | Version: 1.8
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
----------------------------------+--------------------
In Django 1.8, the behavior of SessionStore.flush() was changed according
to the release notes to delete the session cookie. However, with a custom
SESSION_COOKIE_DOMAIN, the custom domain is included when the cookie is
set, but not when it is deleted. This makes browsers ignore the attempted
deletion and the cookie remains.
This is fine for database-backed sessions, since the session is also
removed from the database, but with cookie-backed sessions the end result
is that flush() is a no-op, the worst consequence being users are unable
to log out of sites.
Here's an example of Django setting the session cookie on login:
`Set-Cookie: sessionid="<redacted>"; Domain=.example.local; expires=Wed,
27-May-2015 22:58:18 GMT; httponly; Max-Age=1209600; Path=/`
And here's an example of it attempting but failing to delete it on logout
(note the lack of Domain field):
`Set-Cookie:sessionid=; expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0;
Path=/`
Steps to reproduce:
1. Start a new Django project. Enable the admin.
2. Add the following settings:
- SESSION_COOKIE_DOMAIN = '.example.local'
- SESSION_ENGINE = 'django.contrib.sessions.backends.signed_cookies'
3. Set up your machine so that "www.example.local" resolves to 127.0.0.1,
then access the development server using "www.example.local".
4. Create a superuser and log into the admin.
5. Click "Logout" in the admin. While the page says you were logged out,
if you go back to "www.example.local/admin" you will still be logged in.
--
Ticket URL: <https://code.djangoproject.com/ticket/24799>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/049.f861188ff712039fb3433d8c9c77e866%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
