Potential for session leakage

[Alacho2]

With the current implementation of the Local Strategy from Passport, there is a potential for the session leaking into new requests after the user refreshes the page.

It is a need for req.session.destroy()-call after req.logout() to remove the session from new requests coming in.

web_development_and_api_design/les08/authentication/src/server/routes.js

Line 46 in 1b88ebe

req.logout();

[arcuri82]

Hi,
thanks! it looks like indeed "logout" just remove the user from the session, but not destroy the session itself. For a REST API (which are supposed to be stateless), this should not be a major issue (unless you keep state linked to the session)... but can never be sure when it comes to security!
I am busy these days, so don't have much time to check it out / investigate it properly. Anyway, it will have no impact on the exam