View Issue Detail

ID	Project	Category	Submitted / Last Updated
00013	UserSpice	User Management Code	2018-03-10 21:06:22 / 2018-05-19 19:15:47
Reported	Brandin Arsenault	Assigned To	Unassigned
Priority	low	Reported	4.3.14
Status	closed fixed	Resolution Version and Commit	4.3.18
Summary	reAuth needs to be baked more
Description	<p>Technically, if you are signed in from two places, and I reAuth myself in one, then if the person at the other computer visits a secure page they won't have to reAuth, defeating the security.</p> <p> </p> <p>Maybe we should use PHP session information to store reAuth times? reAuth is set in the session on sign in? No storing in the DB if we do that??? </p>

November 2021

<p>ReAuth is now controlled within the session variable and is no longer in the DB. Not removing the last_confirm column in case someone uses it, but it will no longer be updated by default.</p>