CODEWITHSUNDEEP
scalasecurityplayframeworksession-cookies
Nick Isaacs
Nick Isaacs

Reputation: 134

Play 2.3 cookie remains usable after expiration

I have a Play 2.3.7 application which I have configured the session.maxAge value. Authentication is done via a token in the session. If I log in, allow the maxAge duration to pass, and attempt to call an endpoint, I get a 401 as expected. However, if I copy the cookie from the browser while it is still valid, let it expire, and then manually add the cookie back to the browser's cookies, it appears that the cookie works again.

My questions are:

  1. Are the cookie expirations only enforced on the browser?
  2. If so, is it left to the developer to permanently expire cookies if desired?

Upvotes: 3

Views: 112

Answers (1)

Andriy Kuba
Andriy Kuba

Reputation: 8263

Short answers

  1. Yes
  2. Yes

In details

It looks like you did just simple authentification, so you store all session information in the cookies. Play only ensure that cookie is correctly signed. That's all. So if you will copy and past the same cookie then yes - it will work, and yes - it will work forever (until you change the secret key on the server side)

Even more

Please read @biesior answer to this question Play framework how do sessions and cookies work?

Upvotes: 1

Related Questions