Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Patch Session Expiry for EncryptedCookieStorage #326

Merged
merged 1 commit into from
Oct 10, 2018

Conversation

panagiks
Copy link
Contributor

@panagiks panagiks commented Oct 8, 2018

Relates to #325

@panagiks
Copy link
Contributor Author

panagiks commented Oct 9, 2018

As a note, since the patch is in decrypt the fix is applied retroactively, meaning that sessions created before the patch will still be properly validated and as a result there is no need to generate a new key for the vulnerable applications.

@panagiks
Copy link
Contributor Author

Hello @asvetlov sorry for the ping. Travis and codecov have not triggered (a day after the PR). Is this the expected behavior (i.e. it requires trigger from a maintainer) or is it a malfunction ?

(May be related to travis-ci/travis-ci#7602 as looking at the requests to travis there doesn't seem to be one)

@asvetlov
Copy link
Member

Thanks for the PR.
I don't know what's wrong with Travis but want to merge your changes.
Passed locally.

@asvetlov asvetlov merged commit 87292b8 into aio-libs:master Oct 10, 2018
@panagiks panagiks deleted the fernet_ttl branch October 10, 2018 07:10
panagiks added a commit to panagiks/aiohttp-session that referenced this pull request Oct 10, 2018
asvetlov pushed a commit that referenced this pull request Oct 10, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants