removal of unique_session_id on explicit user logout

[klobuczek]

This change cleans up the unique_session_id from the db when the user logs out. This was necessary as our security department objected that if the user logs out, but the response for some reason doesn't reach the client, or the response is maliciously intercepted, or the browser (or modification of it) doesn't properly invalidate the cookie, or the cookie has been copied before logout, the system can still be accessed using the cookie.

I had to add the conditional to preserve the current behavior of the gem.

[mrcsparker]

Is there any update on when this will get added? I really need this also.

[rahim]

+1

I recently had to implement similar myself for the same reasons - it feels like this should be the default behaviour of session limitable - if you're explicitly blocking concurrent sessions then an old session should be invalidated as soon as we know this. Sometimes this may still only be at next login, but where we know this earlier (through explicit logout) we can minimise the window that a leaked session cookie would be useful to an attacker.