vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Invalidate all session tokens when a user signs out

Browse source 
Fixes https://jira.coreos.com/browse/QS-85
This commit is contained in:
Joseph Schorr 2017-12-07 11:39:27 -05:00
parent d405f6f158
commit 1d1c6f0606
4 changed files with 16 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
test/test_api_usage.py
View file

@ -895,6 +895,7 @@ class TestSignout(ApiTestCase):
def test_signout(self):
self.login(READ_ACCESS_USER)
read_user = model.user.get_user(READ_ACCESS_USER)
json = self.getJsonResponse(User)
assert json['username'] == READ_ACCESS_USER
@ -903,6 +904,10 @@ class TestSignout(ApiTestCase):
# Make sure we're now signed out.
self.getJsonResponse(User, expected_code=401)
# Make sure the user's UUID has rotated, to ensure sessions are no longer valid.
read_user_again = model.user.get_user(READ_ACCESS_USER)
self.assertNotEquals(read_user.uuid, read_user_again.uuid)
class TestConductSearch(ApiTestCase):
def test_noaccess(self):