mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 05:26:47 +00:00
Maurice
ac89895978
A token without a jti past half its life is renewed on every request its cookie authenticates, and each renewal minted a session with a random id. A first page load sends many requests at once, so one browser ended up with several active sessions; only the last cookie survived, and the rest showed up in GET /api/auth/sessions as separate devices until they expired, up to 30 days for remember me. The interceptor now hands the token to SessionsService.renew, which derives the session id from it (a SHA-256 of the token, laid out as a version 8 UUID so it passes the same id check) and inserts the row only if it is not there yet. Every renewal of the same token lands on the same session; if that session was ended in the meantime nothing is renewed, just as for a tracked token. A caller that passes no token gets the old behaviour.