[Bug] API Calls Continue with Expired connect.sid Cookie #991
Comments
Divinelink
added
awaiting triage
gauthier-th
added
confirmed
gauthier-th
added a commit
that referenced
this issue
Oct 2, 2024
The time-to-live (TTL) of cookies stored in the database was incorrect because the connect-typeorm library takes a TTL in seconds and not milliseconds, making cookies valid for ~82 years instead of 30 days. fix #991
3 tasks
|
Impressive bug fix turnaround! 🙌 |
3 tasks
|
🎉 This issue has been resolved in version 2.0.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
bonswouar
pushed a commit
to bonswouar/jellyseerr
that referenced
this issue
Nov 10, 2024
The time-to-live (TTL) of cookies stored in the database was incorrect because the connect-typeorm library takes a TTL in seconds and not milliseconds, making cookies valid for ~82 years instead of 30 days. fix fallenbagel#991
thibodelanghe
pushed a commit
to thibodelanghe/jellyseerr
that referenced
this issue
Dec 18, 2024
The time-to-live (TTL) of cookies stored in the database was incorrect because the connect-typeorm library takes a TTL in seconds and not milliseconds, making cookies valid for ~82 years instead of 30 days. fix fallenbagel#991
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
I'm using the jellyseerr API to make some API calls from my mobile app that I'm building.
Using my Jellyfin credentials, the
/auth/localgenerates an authentication cookie that has an expiration date, however, even when the expiration date passes, I'm still able to successfully make API calls without getting any unauthorised/expired sessions error.The server should be responsible for validating the session cookie (connect.sid) and blocking or rejecting API calls when the session has expired. Handling this on the frontend would be a workaround, but the correct approach is to fix it at the server level to ensure proper security and session management.
Version
1.9.2
Steps to Reproduce
Make any API calls using an expired connect.sid auth cookie.
Screenshots
No response
Logs
No response
Platform
desktop
Device
This is not relevant
Operating System
This is not relevant
Browser
This is not relevant
Additional Context
No response
Code of Conduct
The text was updated successfully, but these errors were encountered: