Browse Source

[core] Invalidate sessions when changing auth backend

Romain Rigaux 10 years ago
parent
commit
0ff83b22c8
1 changed files with 2 additions and 2 deletions
  1. 2 2
      desktop/core/src/desktop/settings.py

+ 2 - 2
desktop/core/src/desktop/settings.py

@@ -338,8 +338,8 @@ EMAIL_HOST_PASSWORD = desktop.conf.get_smtp_password()
 EMAIL_USE_TLS = desktop.conf.SMTP.USE_TLS.get()
 DEFAULT_FROM_EMAIL = desktop.conf.SMTP.DEFAULT_FROM.get()
 
-# Used for securely creating sessions.  Should be unique and not shared with anybody.
-SECRET_KEY = desktop.conf.SECRET_KEY.get()
+# Used for securely creating sessions. Should be unique and not shared with anybody. Changing auth backends will invalidate all open sessions.
+SECRET_KEY = desktop.conf.SECRET_KEY.get() + str(AUTHENTICATION_BACKENDS)
 if SECRET_KEY == "":
   import uuid
   SECRET_KEY = str(uuid.uuid4())