sneak
7fd9994d4b
check / check (push) Waiting to run
A login session was a cookie with nothing kept on the server, so /logout removed it from one browser and a copy kept working for 30 days. Every login is made with the one signing key, so /logout now ends them all: the session manager keeps the time of the latest logout, saves it in the new logout table so it outlasts a restart, and refuses a session made before it. A /logout without a valid session ends none and only removes the cookie, so another site cannot log everyone out. A logout that cannot be saved answers 500. session.NewManager, which existing tests use, keeps logouts in memory only; pixad uses NewManagerWithDatabase. Model: opus-5-5