sneak 7fd9994d4b Logging out ends every login session (closes #256) ...

A login session was a cookie with nothing kept on the server, so /logout
removed it from one browser and a copy kept working for 30 days. Every
login is made with the one signing key, so /logout now ends them all:
the session manager keeps the time of the latest logout, saves it in the
new logout table so it outlasts a restart, and refuses a session made
before it. A /logout without a valid session ends none and only removes
the cookie, so another site cannot log everyone out. A logout that
cannot be saved answers 500. session.NewManager, which existing tests
use, keeps logouts in memory only; pixad uses NewManagerWithDatabase.

Model: opus-5-5

2026-10-15 03:03:52 +00:00

..

session_cookie_attributes_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

session_logout_test.go

Test that logging out ends a copied login session (part of #256)

2026-10-15 02:51:01 +00:00

session_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

session.go

Logging out ends every login session (closes #256)

2026-10-15 03:03:52 +00:00