Browser shares the cookies among all the open sessions to that general address

[marioscube]

A few days ago I made an expiring share in latest beta pupcloud on Docker.

(date just for example, actual date was earlier)

But it never seems to expire............

Did I do something wrong? Not enabled in this version? Is my memory of setting the share to expire wrong (could be)?

Can someone check it?

EDIT:
I actually got a "Link Expired" message, but then was able to login and continue........ I did not clean the browser cache in between.

Copied the url to a new browser. And now I cannot login anymore with "Link expired".

After logout I cannot log in anymore. That's OK.
.... and I can login again.......???

So just as log as you do not logout and keep your browser open ....... Let's test some more!

[proofrock]

Thanks! But sorry, I can't follow you:

• if you log out, can you log in with an expired link or not?
• when a link expires and the browser window is open, does it log you out or not?

I tested this behaviour for some time, but it's quite difficult to test properly, at midnight I'm generally in another world (I know, I know, I am getting old it seems). So any pointer here on what to test will be precious.

[marioscube]

I wrote this post late at night and incremental.
Let me take a more structured approach now.

Question: Does a share expire at midnight on the date picked or after the day? For example: date to expire 25th may. Does it expire on midnight between 24th an 25th or between 25th and 26th.

Issue:
pupcloud is latest beta docker

In a browser I have 2 tabs:

• share user John that does not expire
• share user James that does expire (if url copied to other browser it works as expected)
• After docker has been stopped (for the night) and restarted
  1 - if I log in on "James" I get "link expired" (OK)
  2 - if I then login on "John" I can login after "wrong password invalid address". I expect this.
  3 - if I then login into "James" I can login (?) No more "Link Expired".
  4 - If I copy both shares into another (private, no cookies) browser I see the same behaviour.

This all works as long as the browser is open or I have the links.

After some more testing: James logs in on the John session (url says "James").

I know this is a very fringe case.
And this is not actually a (big) security risk.

[proofrock]

Maybe not, but it's very wrong. I'll look into it. Thanks!

[proofrock]

After some more testing: James logs in on the John session (url says "James").

How can you see that? Does James visualize John's files?

[marioscube]

I (test) share other files (directory's)with John and James. So I know who is John and who isJames.
And I says so in the url.

If the James session is expired he can login on the John session if they use the same browser and John session is open in that browser.

[proofrock]

Ouch, that's why. It seems the browser shares the cookies among all the open sessions to that general address. So this is not particularly related to expiration, is it? If you agree, could you kindly change the subject so that we can properly track the issue? I'll think about a possible solution. Maybe putting the profile in the cookie is a way.

[marioscube]

Done.

[marioscube]

Taking a well earned vacation? ;-)

[proofrock]

Taking a well earned vacation? ;-)

You're perfectly right, in the last months I've been busy in a thousand things, and I don't have the necessary focus. If things don't change in the near future, I'll declare a suspension of the project, to set expectations for people 🙁 Although I wouldn't want to. Sorry.

[marioscube]

No problem!

Life comes first.

pupcloud is already OK as it is.

We’ll see you back when you find the necessary focus.

[DarrenPIngram]

Just to confirm I hit the same issue when coming to deploy Pupcloud. Hopefully you won't suspend the project as it is a nice alternative to Filebrowser (I have offered both to users for one share, and some prefer Pupcloud over Filebrowser).

Do you even have an estimate of when you might be back and possibly in a position to look at the issue? Absolutely not pressing the situation, but if you know it is "unlikely" I can cancel the planned roll-out or manage expectations accordingly.

I am hoping, based on my own experiences, a few nice UI change requests, and a browse of issues, that Pupcloud is already quite established so it shouldn't be a problem child for you going forward.