Explorar o código

[core] Invalidate sessions when changing auth backend

Romain Rigaux %!s(int64=11) %!d(string=hai) anos
pai
achega
0ff83b22c8
Modificáronse 1 ficheiros con 2 adicións e 2 borrados
  1. 2 2
      desktop/core/src/desktop/settings.py

+ 2 - 2
desktop/core/src/desktop/settings.py

@@ -338,8 +338,8 @@ EMAIL_HOST_PASSWORD = desktop.conf.get_smtp_password()
 EMAIL_USE_TLS = desktop.conf.SMTP.USE_TLS.get()
 DEFAULT_FROM_EMAIL = desktop.conf.SMTP.DEFAULT_FROM.get()
 
-# Used for securely creating sessions.  Should be unique and not shared with anybody.
-SECRET_KEY = desktop.conf.SECRET_KEY.get()
+# Used for securely creating sessions. Should be unique and not shared with anybody. Changing auth backends will invalidate all open sessions.
+SECRET_KEY = desktop.conf.SECRET_KEY.get() + str(AUTHENTICATION_BACKENDS)
 if SECRET_KEY == "":
   import uuid
   SECRET_KEY = str(uuid.uuid4())