#31970: Logging in from one browser logs me out from other browsers
----------------------------------+--------------------------------------
Reporter: אורי | Owner: nobody
Type: Bug | Status: closed
Component: contrib.sessions | Version: 3.1
Severity: Normal | Resolution: worksforme
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
----------------------------------+--------------------------------------
Comment (by אורי):
From https://docs.djangoproject.com/en/3.1/releases/3.1/:
> The default iteration count for the PBKDF2 password hasher is increased
from 180,000 to 216,000.
So I guess, if a user's password was hashed with 180,000 iterations with
Django <= 3.0, and then they log in with Django 3.1, then the password
will be hashed with 216,000 iterations, and all the other sessions become
invalid (although they are not changed in the sessions table). So all
other browsers will be logged out. This will happen any time the number of
iterations will change.
https://github.com/django/django/commit/b5db65c4fbcf05cb03d039166abf115930dc7577
Did you check that if you login with Django 3.0 with 2 browsers, and then
upgrade to 3.1 and then logout and login again, you are still logged in
with the other browser?
--
Ticket URL: <https://code.djangoproject.com/ticket/31970#comment:7>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/069.b1bd8c2c8443789b3d299ff9f10d32fb%40djangoproject.com.
