Bug #568

LiveUser::tryLogin leftover cookie on error

Details

Submitted	2004-01-13 19:17 UTC
From	jmikola at burgiss dot com
Assigned	arnaud
Status	Closed
Package	LiveUser
PHP Version	Irrelevant
OS	ANY
Roadmaps	(Not assigned)

Comments

[2004-01-13 19:17 UTC] jmikola at burgiss dot com

Description:
------------
the following is in regard to the code around the LiveUser error thrown when passwords hashes in the cookie to not match:

in the event that the [remember-me?] cookie is either found to have invalid data or incorrect hashes of the password, is it reasonable to just erase the cookie? suppose the error is thrown, and the login process and application action is aborted. if the user retries the login, his cookie is still present, and incorrect, and it also has precedence over the form input; as long as the cookie is set, the form input will never be checked. short of the end user clearing their browser cookie manually, i don't see an escape for the end user from this scenario.