David Dreschner f0b16345bb fix(session): Prevent stale requests from replacing a regenerated session ...

Regenerating the session id - on login, on unlocking a public share, on a
remember-me login - leaves the requests that are already on their way with
the previous session cookie. PHP starts a session for that id again and
sends it back in a Set-Cookie header, so the id the browser had just stored
is overwritten and everything the regenerating request did is lost. For a
logged-in user who unlocks a password-protected public share this shows up
as a 401 on PROPFIND /public.php/dav/files/<token>/.

Mark the old session as superseded instead of deleting it, and move the
requests that still arrive on it to an empty session. Within a grace period
of 60 seconds they get no session cookie at all, so they can no longer
replace the regenerated id the browser holds. reopen() does the same and
only sends a cookie when the id it was given is gone for good.

Assisted-by: ClaudeCode:claude-opus-5
Signed-off-by: David Dreschner <david.dreschner@nextcloud.com>

2026-11-04 14:09:14 +00:00

..

CryptoSessionDataTest.php

chore: add missing Override attribute to test files

2026-04-28 21:29:28 +02:00

CryptoWrappingTest.php

chore: add missing Override attribute to test files

2026-04-28 21:29:28 +02:00

InternalTest.php

fix(session): Prevent stale requests from replacing a regenerated session

2026-11-04 14:09:14 +00:00

MemoryTest.php

chore: Apply new coding standard to all files

2026-06-01 13:46:39 +02:00

Session.php

chore: add missing Override attribute to test files

2026-04-28 21:29:28 +02:00