mirror of
https://github.com/mattermost/mattermost.git
synced 2026-09-19 10:12:47 +08:00
Alejandro García Montoro
d6d2c50189
newSessionUpdateToken removed the old session row from the DB but did not clear the in-memory session cache. Because GetSession returns the cached entry without querying the DB, the rotated (old) access token remained valid for up to SessionCacheInMinutes (default 10 min) after rotation. Add a ClearSessionCacheForUser call after the DB removal, matching what RevokeAccessToken already does, so the old token is rejected immediately. Add a regression test that verifies the old token hits the cache before refresh and is rejected right after rotation.