Livio Spring fda19dc85b fix(login v1): handle old sessions in logout (#10926) ...

# Which Problems Are Solved

Sessions created through login UI (v1) automatically get assigned an ID
after creation. This change was introduced with the OIDC back-channel
logout implementation. Sessions created before that don't have an ID and
are updated on the next (re-)authentication.
A customer now reached out, that a logout from Console was resulting in
an error. This is due to at least one session not having an ID (<null>
in sql) in the same user agent.

# How the Problems Are Solved

Since the sessionID is not used in the specific situation, we just
assign the userID as sessionID. This way all sessions are properly
terminated.

# Additional Changes

None

# Additional Context

- relates to support request
- requires backport to v4.x

2025-10-18 10:18:36 +02:00

..

model

fix(login): make sure first email verification is done before MFA check (#9039)

2024-12-13 11:37:20 +00:00

repository

fix(login v1): handle old sessions in logout (#10926)

2025-10-18 10:18:36 +02:00