finnandClaude Opus 5.5
8e32727fcd
The session store held at most 100 sessions and evicted the least recently used one. Anyone with an account could log in 101 times and thereby log out every other user, including the admins. - Each user has at most 10 sessions. A new login above the limit removes the user's own least recently used session (by _last_seen). - There is no global limit anymore: the store only accepts sessions with a user_id (raises SessionWithoutUser otherwise), so it is bounded by 10 * number of users. Anonymous users still create no store entries. - save_session clears an invalid session before re-raising, since Flask saves the session again for the error response. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
21 lines
316 B
Python
21 lines
316 B
Python
class MaxException(Exception):
|
|
pass
|
|
|
|
|
|
class ImproperlyConfigured(MaxException):
|
|
pass
|
|
|
|
|
|
class NotFound(MaxException):
|
|
pass
|
|
|
|
|
|
class SessionWithoutUser(MaxException):
|
|
pass
|
|
|
|
|
|
class PermissionDenied(MaxException):
|
|
def __init__(self, message):
|
|
super().__init__()
|
|
self.message = message
|