From d1482bf1ebfdb075ecf685a0531ee1b50c99723c Mon Sep 17 00:00:00 2001 From: sneak Date: Thu, 15 Oct 2026 05:17:58 +0000 Subject: [PATCH] Say that losing the state directory forgets the latest logout (part of #256) The state directory bullet in README.md and the session package doc now say that the time of the latest logout is kept in the database, which a restart without a persistent volume loses. Model: opus-5-5 --- README.md | 9 +++++---- TODO.md | 23 ++++++++++++----------- internal/session/session.go | 4 +++- 3 files changed, 20 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index b842134..5306624 100644 --- a/README.md +++ b/README.md @@ -71,9 +71,10 @@ The state directory (`state_dir`, `/var/lib/pixa` in the container) holds the database and the disk cache: - It needs a persistent volume: without one, every restart starts with an empty - cache. In the container, the startup script gives the directory to the user - pixa runs as (uid 65532) and sets its mode to `750`; outside it, that user - must be able to write the directory. + cache and forgets the latest logout, so the login sessions that logout ended + work again (see Encrypted URLs). In the container, the startup script gives + the directory to the user pixa runs as (uid 65532) and sets its mode to `750`; + outside it, that user must be able to write the directory. - `cache_max_bytes` limits the source and transformed images together. The database, the metadata files, the `.meta` file beside each transformed image and files still being written come on top, and eviction runs in the @@ -360,7 +361,7 @@ nor change what it asks for. with the one signing key, so logging out ends every login session, in every browser: pixa saves the time of the latest logout in its database and refuses a login session made before it, a copy of the session cookie included, also - after a restart. + after a restart that keeps the state directory (see Deployment). 2. On the generator page, give the source image's URL, the width and height, the format, quality and fit, and how long the URL lasts, then submit the form (`POST /generate`). The format is JPEG XL unless another is chosen; a form diff --git a/TODO.md b/TODO.md index a0b3050..7b44291 100644 --- a/TODO.md +++ b/TODO.md @@ -70,6 +70,18 @@ P2: security: per-origin rate limiting and the query now have each `%` written as `%25` and each `:` as `%3A`; a path and query holding neither are signed and keyed as before. Signature Specification in `README.md` says so. +- 2026-10-15 logging out ends every login session (closes #256): a login session + was a cookie with nothing kept on the server, so `/logout` removed it from one + browser and a copy of it kept working for its 30 days. Every login is made + with the one signing key, so `/logout` now ends them all: the session manager + keeps the time of the latest logout, saves it in the new `logout` table so + that it outlasts a restart, and refuses a session made before it. A restart + without a persistent volume for the state directory forgets it. A `/logout` + without a valid login session, such as one another site makes a browser send + without the `SameSite=Strict` cookie, ends none and only removes the cookie. A + logout that cannot be saved answers 500. `session.NewManager`, which the tests + use, keeps logouts in memory only; pixad uses + `session.NewManagerWithDatabase`. - 2026-10-15 the example config allowlists no host (closes #249): it allowlisted `github.com` and `user-images.githubusercontent.com`, where anyone can put an image, so a deployment set up as Getting Started says served those images to @@ -87,17 +99,6 @@ P2: security: per-origin rate limiting answered 500. Once the limit is used up, the fetcher now reads one more byte: if the body has ended it is accepted, and if there is more it is refused with `ErrResponseTooLarge`, as before. -- 2026-10-15 logging out ends every login session (closes #256): a login session - was a cookie with nothing kept on the server, so `/logout` removed it from one - browser and a copy of it kept working for its 30 days. Every login is made - with the one signing key, so `/logout` now ends them all: the session manager - keeps the time of the latest logout, saves it in the new `logout` table so - that it outlasts a restart, and refuses a session made before it. A `/logout` - without a valid login session, such as one another site makes a browser send - without the `SameSite=Strict` cookie, ends none and only removes the cookie. A - logout that cannot be saved answers 500. `session.NewManager`, which the tests - use, keeps logouts in memory only; pixad uses - `session.NewManagerWithDatabase`. - 2026-10-13 `fit=outside` no longer makes an output above 8192 on a side (closes #257): it scales the image to cover the requested size, and the side scaled past that size was held to no maximum, so `1x8192?fit=outside` of a diff --git a/internal/session/session.go b/internal/session/session.go index c4ea3d2..0097dd4 100644 --- a/internal/session/session.go +++ b/internal/session/session.go @@ -1,4 +1,6 @@ -// Package session provides encrypted session cookie management. +// Package session provides encrypted session cookie management, and keeps the +// time of the latest logout in the database so that a logout ends every +// session made before it. package session import (