Skip to content
Snippets Groups Projects
Commit 77fbd851 authored by Benni Mack's avatar Benni Mack Committed by Georg Ringer
Browse files

[!!!][TASK] Remove lockHashKeyWords functionality

The TYPO3 Core used the "useragent" to create a hashbase
by default to harden the session hijacking functionality.

This very very old feature adds a tiny bit of security on top,
however it has the drawback that users get logged out (of BE or FE)
if their browser updates (due to evergreen browsers or security
updates as the user agent string changes). This is very inconvenient
for websites that use a very long session time for logged in users
in the frontend (or backend) when using TYPO3 as a platform or
application.

It was originally concepted so it could be extended but there is no
hook to do so, and extending all classes does not really make a lot
of sense in the hierarchical PHP class structure.

Resolves: #79513
Releases: master
Change-Id: I78e58210da80c7c1544a644e8e10bc1f667b5bf1
Reviewed-on: https://review.typo3.org/51437


Tested-by: default avatarTYPO3com <no-reply@typo3.com>
Reviewed-by: default avatarChristian Kuhn <lolli@schwarzbu.ch>
Tested-by: default avatarChristian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: default avatarGeorg Ringer <georg.ringer@gmail.com>
Tested-by: default avatarGeorg Ringer <georg.ringer@gmail.com>
parent c0d87152
Branches
Tags
No related merge requests found
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment