Bug #90568

BE user cookie set regardless of session

Added by Philipp Gampe 9 months ago. Updated about 2 months ago.

Status:
Closed
Priority:
Must have
Assignee:
Category:
Authentication
Target version:
-
Start date:
2020-02-28
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
9
PHP Version:
Tags:
Complexity:
medium
Is Regression:
Sprint Focus:

Description

The BE user cookie is always set once a user visited the /typo3 login page. Even after logout, a BE user cookie is still present.

Since a BE user cookie is the only way viable way to detect a BE session, it should only be present if there is a current session. This is important for CDNs to bypass cache for active sessions.

That means a) the cookie should only be set after successful login and b) the cookie should be removed during logout.


Related issues

Related to TYPO3 Core - Task #89877: Cookie "lastLoginProvider" appears to serve no true purposeClosed2019-12-06

Actions
Related to TYPO3 Core - Bug #92035: Backend sets InstallToolSession cookie on logoutClosedMarkus Klein2020-08-17

Actions
#1

Updated by Susanne Moog 9 months ago

  • Related to Task #89877: Cookie "lastLoginProvider" appears to serve no true purpose added
#2

Updated by Gerrit Code Review 9 months ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63629

#3

Updated by Gerrit Code Review 6 months ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63629

#4

Updated by Markus Klein 3 months ago

  • Related to Bug #92035: Backend sets InstallToolSession cookie on logout added
#5

Updated by Markus Klein 3 months ago

  • Assignee set to Markus Klein
  • Complexity set to medium
#6

Updated by Gerrit Code Review 3 months ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63629

#7

Updated by Gerrit Code Review 3 months ago

Patch set 1 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/65372

#8

Updated by Benni Mack 3 months ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
#9

Updated by Benni Mack about 2 months ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF