Severity: HIGH
Location: src/Middleware/AuthMiddleware.php:38-45
Bug: Ban and 2FA enforcement can be delayed up to 60s after state change.
Fix: Keep cache for session-row + idle-timeout, but always run lightweight ban/suspension query.
Status: open. Will reply with remediation details when resolved.
Resolved.
AuthMiddleware now runs a cheap ban/suspension check on the 60-second-cache fast path (src/Middleware/AuthMiddleware.php). A user whose role drops to 1 (banned) or whose suspended_until passes is kicked out on their next request, not up to 60 seconds later.
The heavy session-row / idle-timeout / 2FA-enforcement work still benefits from the 60-second cache; only the lightweight state query runs on every request. Net cost: one extra indexed SELECT per page for signed-in users.
Locking this thread.
We noticed you are visiting from a mobile device. We are glad you are here, but know that 6502ish is best experienced on the desktop. Some features are not easily used via mobile and your experience may vary from the full experience via desktop.