Hacker News Reader

Pretty sure this can be fixed with a timestamp in the session data. You can either expire the timestamp by time or by keeping a datetime field on the user and updating the timestamp after a password change. Or you can use a combination of these two.

This is not a new issue. It is a well known limitation of the cookie store. I've been working around this with timestamps for years.

View on HN

Can you share maybe the code you're using to do that?

As well: rotating the secret token every night could probably be used to discard all existing cookies, right? (although this is a bit brute force and will kick out anyone currently using the app).

Nope. The last version I wrote is buried in a rails app at a company I no longer work for.

It's a three or four line before filter in the application controller. I reimplement it every time since it's relatively simple.

I don't have it on any public code since it's also the last thing I implement before launching.

Reply on news.ycombinator.com