andrewmusselman opened a new issue, #1361: URL: https://github.com/apache/tooling-trusted-releases/issues/1361
### Summary `Store.create()` unconditionally inserts a new `UserSession` row on each successful OAuth login with no cap on parallel sessions per account and no documented policy on whether concurrent sessions are permitted. ### Details There is no cap on the number of parallel sessions per account and no documented policy stating whether concurrent sessions are permitted, how many are allowed, or what happens when a limit is reached. **Attacker capability:** An authenticated user (or an attacker holding one compromised credential) can accumulate unlimited live sessions. **Impact:** Low — unbounded session rows per account increase the window and spread of a compromised credential and complicate revocation reasoning, but there is no direct C/I/A breach; `revoke_by_uid` does delete all sessions for a uid. **Affected files:** - `atr/sessions.py` **ASVS:** 7.1.2 (L2) ### Remediation Document the concurrent-session policy for ATR (e.g., "unlimited concurrent sessions permitted; all are revoked atomically on credential revocation, logout-all, or account deactivation") as part of the session risk analysis. If a ceiling is desired, enforce it in `Store.create()`. ### Acceptance Criteria - [ ] Fixed - [ ] Test added — assert that the documented session limit (or unlimited policy) is enforced as expected ### References - ASVS 7.1.2 - Source report: `7.1.2.md` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
