Skip to content

fix(auth): Always check cookies support to create a session - #64591

Closed
artonge wants to merge 1 commit into
masterfrom
artonge/fix/test_cookie_support
Closed

artonge wants to merge 1 commit into
masterfrom
artonge/fix/test_cookie_support

Conversation

@artonge

@artonge artonge commented Sep 20, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

Signed-off-by: Louis Chmn <louis@chmn.me>
@artonge
artonge requested a review from a team as a code owner September 20, 2026 13:56
@artonge
artonge requested review from CarlSchwan and icewind1991 and removed request for a team September 20, 2026 13:56
@artonge artonge self-assigned this Sep 20, 2026

@come-nc come-nc left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed in the end, the current code makes sense.

Explanation:

  • For basic auth with password, we wait until we are sure the client supports cookies (by setting a test cookie and reading it back on the next request) before we create a session in DB and consider the PHP session as a valid one.
  • For basic auth with an app-password, we already have a DB line we can use for the session, the one of the app-password, so we directly mark the session as valid and link it to the app password, no need for test cookie.

@come-nc come-nc closed this Sep 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants