Andrey Antukh 7c85837290

🐛 Fix session invalidation on logout to prevent token replay (#11317) ...

Logout only cleared the auth-token cookie but never deleted the
server-side row because delete-fn read ::id which wrap-authz no longer
sets since 363b4e3778. Make delete-fn delete via ::session/:id attached
by wrap-authz so replayed tokens are rejected (CWE-613, GHSA-mj9f-5cwq-7p3q).

Add regression tests covering invalidation, idempotency and isolation
of other sessions. Fix verified with Red→Green TDD and full backend
suite (677 tests).

Closes #11316

AI-assisted-by: muse-spark-1.2-contributor

2026-08-21 12:55:24 +02:00

..

dev

♻️ Refactor internal organization of system initialization

2026-07-22 14:18:51 +02:00

resources

🐛 Add concurrency limit to import-binfile RPC handler (#11024)

2026-08-17 11:08:07 +02:00

scripts

✨ Add media-processor service for image and font processing (#10767)

2026-08-05 09:41:48 +02:00

src

🐛 Fix session invalidation on logout to prevent token replay (#11317)

2026-08-21 12:55:24 +02:00

test

🐛 Fix session invalidation on logout to prevent token replay (#11317)

2026-08-21 12:55:24 +02:00

build.clj

🐛 Fix unexpected exception on logger caused by log4j2 plugin

2023-02-11 00:52:23 +01:00

deps.edn

🐛 Add backend password validation with complexity rules and dictionary check (#11059)

2026-08-06 10:17:14 +02:00

package.json

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

pnpm-lock.yaml

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

pnpm-workspace.yaml

⬆️ Update pnpm dependencies across all modules

2026-08-04 14:15:35 +02:00

tests.edn

🔧 Change backend test runner to kaocha

2024-05-29 19:05:04 +02:00