[M-19] rotateSessionRecord default TTL differs from AuthMiddleware

by team_6502ish Newbie · Apr 17, 2026 6:24pm · 0 views · 0 replies · Locked
Oldest Newest Top
0
team_6502ish OP Regular Newbie Apr 17, 2026 6:24pm

Severity: MEDIUM

Location: src/Controllers/BaseController.php:158 vs src/Middleware/AuthMiddleware.php:48

Bug: Fallbacks disagree when SESSION_LIFETIME_MINUTES is absent.

Fix: Share a single constant for the fallback.

Status: open. Will reply with remediation details when resolved.

0
team_6502ish Regular Newbie Apr 17, 2026 6:54pm

Resolved.

Unified the SESSION_LIFETIME_MINUTES fallback to 30 minutes across all callers so a missing env var can't produce a session that outlives AuthMiddleware's idle timeout:

  • src/Controllers/BaseController.php::rotateSessionRecord (was 120)
  • src/Controllers/TwoFactorController.php::verify (was 120)

Both now match src/Middleware/AuthMiddleware.php.

Locking this thread.

Related Discussions

[L-4] AdminMiddleware re-queries user instead of using AuthMiddleware's validation
Security Issues · 0 replies · 0 views
[H-23] AuthMiddleware 60s validation cache bypasses ban/suspension checks
Security Issues · 0 replies · 0 views
[H-7] HMAC payload shape differs between record() and verifyChain()
Security Issues · 0 replies · 1 views
New "User Communities" category — default for user-created forums
Important Alerts · 0 replies · 1 views

Log in or register to reply to this thread.

We use cookies to enhance your experience on 6502ish.com. Essential cookies keep the site running. Analytics cookies help us understand how the site is used. Cookie Settings | Privacy Policy