[Zope-Coders] Re: [ZC] 527/ 2 Reject "SESSION and authentication"

[Julien Jalon]

Le lundi 19 ao=FBt 2002, =E0 03:01 , Collector: Zope Bugs, Features, and=20=

Patches ... a =E9crit :

> Issue #527 Update (Reject) "SESSION and authentication"
>  Status Rejected, Zope/feature+solution medium
> To followup, visit:
>   http://collector.zope.org/Zope/527
>
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> =3D Reject - Entry #2 by mcdonc on Aug 19, 2002 9:01 am
>
>  Status: Pending =3D> Rejected
>
>> =3D Request - Entry #1 by Anonymous User on Aug 19, 2002 8:54 am
>>
>> the REQUEST.SESSION is not "cleared" when you log out (or log in).
>> In fact, the session cookie should change when you log out or log in.
>
> In Zope, unlike other systems, sessions are not intimately tied to=20
> authentication.  It is the programmer's responsibility to clear the=20
> contents of the session when a user logs out.  That said, there is at=20=

> least one Session User Folder on Zope.org out there that might help=20
> with this.
>

In fact, you're totally right and I do agree with you. That's why it was=20=

just a "medium" feature. But, in fact, how many people using Zope do=20
know that?
How many Zope sites have that sort of potential security hole?

--
Julien Jalon
<http://software.julien-jalon.org/>
<http://nuxeo.com/>