Since rMW5a7ce09d3a07: Move allowSecuritySensitiveOperationIfCannotReauthenticate to SessionProvider, providers can decide how to handle security-sensitive operations if reauthentication is not an option. CentralAuthTokenSessionProvider should inherit the elevation flags from the session from which it was created, and decide based on that.
Description
Description
Related Objects
Related Objects
- Mentioned In
- T423537: Site JS reauth hack can be bypassed using 'centralauthtoken'
- Mentioned Here
- T430028: Use central session for reauthentications
rMW5a7ce09d3a07: Move allowSecuritySensitiveOperationIfCannotReauthenticate to SessionProvider
T423537: Site JS reauth hack can be bypassed using 'centralauthtoken'
Event Timeline
Comment Actions
Maybe we should replace SessionProvider::allowSecuritySensitiveOperationIfCannotReauthenticate() with just SessionProvider::allowSecuritySensitiveOperation( $operation, $session ) where the AuthManager:lastAuthTimestamps session data array is just the default SessionProvider implementation (that would also make T430028: Use central session for reauthentications straightforward), and expose something like Session::getAllowedOperations() returning an operation name => expiry map that can be copied either into the CA token itself (which has recently been changed to a JWT) or the token store data, in CentralAuthApiTokenManager::getToken()