[omattsson]

Closes #699

Summary

Logout could leave a session usable:

• Without the cookie: a logout with only an access token ended nothing on the server.
• Other access tokens: other access tokens of a logged-out session (another tab, a refresh in flight) kept working until they expired.
• Logout-all: the user's earlier access tokens kept working over HTTP.

Session blocks

• sessionstore gets BlockSession(sid, until) and IsSessionBlocked(sid): a new entry kind session_block in session_entries (MySQL), a map in the memory store.
• No migration: Cleanup already deletes every kind by expires_at.
• No shortening: a re-block keeps the later expiry (GREATEST on MySQL).
• Where it's checked: middleware.RevocationStatus checks the jti, then the session, then the user, so JWT auth, the /ws upgrade and the socket revalidation reject tokens of a blocked session with 401 "Session revoked". The revalidation now knows each socket's session.
• Refresh: refresh and its grace path refuse a blocked session and revoke its family.
• Store errors: every check fails open, as the existing ones do.

Logout

• Which session: it revokes the family of the cookie token, and of the bearer's sid when the cookie is missing or unknown.
• Cookie and bearer of different sessions or users: both end. Either credential could end its own session alone, so ending both gives no new power.
• Order: revoke, then block the session until now + access-token lifetime + 1 minute, then block the jti and close its sockets. Refresh signs before its session re-check, so any token that passed the re-check predates the block.
• Failed revoke: a long block (now + SESSION_MAX_LIFETIME + 1 minute), and the answer is 500.

Logout-all and others

• Logout-all now calls BlockUser, like disable and password reset.
• Admin revokes (delete, disable, password reset, role change) now revoke before they block, which closes the same race.
• Refresh-token reuse (replay) also blocks the family.

Upgrade notes

For the release text:

Logout now ends the session of the access token even without the refresh cookie, and every other access token of that session stops working. Logout-all stops all earlier access tokens of the user. During a rolling update, older replicas do not check the new session block, and a logout they serve without a cookie does not end the session. No migration.

Tests

• Covered: every acceptance criterion of fix(auth): logout leaves the session usable without the cookie, and through other access tokens #699.
  • bearer-only logout;
  • other tokens of the session on HTTP and /ws, and the socket revalidation;
  • other sessions unaffected;
  • logout-all;
  • cookie and bearer of different users;
  • races after the refresh re-check (logout, grace refresh, logout-all, password reset, role change);
  • replay, and failed revokes;
  • the revoke-before-block order. A mutation test confirmed that the tests fail when the order is swapped or the session block is missing.
• Results:
  • go vet ./... and go vet -tags integration for database and sessionstore: clean.
  • go test ./... -short: pass. go test -race for handlers, middleware, sessionstore and websocket: pass.
  • make gosec: 0 issues.
  • The sessionstore MySQL integration tests (19, including 6 new) pass on MySQL 8.4.4.
• Review: two rounds of security-focused review.
  • Two medium findings were fixed: the failed-revoke block, and refresh reading the block. A third, the missing clock-skew margin on the user block, is documented.
  • The re-review found nothing critical, high or medium.

Not in this PR

• Logout-all, failed revoke: the refresh tokens stay valid, so a refresh after the user block still works. The 500 tells the client. Blocking each active family would close it.
• Clock skew: the user block has no clock-skew margin. It's documented in Swagger and auth-sessions.md.
• Test gap: no test covers the 499 branch of the refresh block check.
• Queries: one query for the jti, session and user checks, instead of three.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 58635a44-b513-441f-b1fa-00476b6591a8

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}