{"action":"created","issue":{"url":"https://api.github.com/repos/fguillot/kanboard/issues/1391","labels_url":"https://api.github.com/repos/fguillot/kanboard/issues/1391/labels{/name}","comments_url":"https://api.github.com/repos/fguillot/kanboard/issues/1391/comments","events_url":"https://api.github.com/repos/fguillot/kanboard/issues/1391/events","html_url":"https://github.com/fguillot/kanboard/issues/1391","id":112263583,"number":1391,"title":"Reverse proxy user is only checked at login","user":{"login":"mbugeia","id":6364564,"avatar_url":"https://avatars.githubusercontent.com/u/6364564?v=3","gravatar_id":"","url":"https://api.github.com/users/mbugeia","html_url":"https://github.com/mbugeia","followers_url":"https://api.github.com/users/mbugeia/followers","following_url":"https://api.github.com/users/mbugeia/following{/other_user}","gists_url":"https://api.github.com/users/mbugeia/gists{/gist_id}","starred_url":"https://api.github.com/users/mbugeia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbugeia/subscriptions","organizations_url":"https://api.github.com/users/mbugeia/orgs","repos_url":"https://api.github.com/users/mbugeia/repos","events_url":"https://api.github.com/users/mbugeia/events{/privacy}","received_events_url":"https://api.github.com/users/mbugeia/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/fguillot/kanboard/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-10-20T01:12:59Z","updated_at":"2015-10-26T17:04:25Z","closed_at":null,"body":"I use Kanboard with reverse proxy authentification and I have kind of a security issue.\r\n\r\n1. a user1 is logged in\r\n2. user1 logged out of the reverse proxy\r\n3. user2 logged in on the reverse proxy and go to kanboard\r\n4. user2 is connected to kanboard with the credential of user1\r\n\r\nThe reason seems to be simple: kanboard doesn't check if the session user match the reverse proxy user so while the kanboard session exist, the user doesn't change. And a reverse proxy only take care of destroying its own sessions, not the applications ones.\r\n\r\nI can mitigate the risk by setting a short SESSION_DURATION in config file but for me it's not a very good solution. Kanboard should always check that the session's user is the same as the user sent by the reverse proxy. \r\n\r\nI believe this has to happen in this function: https://github.com/fguillot/kanboard/blob/master/app/Model/Authentication.php#L44-L51\r\nWhat do you think ?"},"comment":{"url":"https://api.github.com/repos/fguillot/kanboard/issues/comments/151210467","html_url":"https://github.com/fguillot/kanboard/issues/1391#issuecomment-151210467","issue_url":"https://api.github.com/repos/fguillot/kanboard/issues/1391","id":151210467,"user":{"login":"mbugeia","id":6364564,"avatar_url":"https://avatars.githubusercontent.com/u/6364564?v=3","gravatar_id":"","url":"https://api.github.com/users/mbugeia","html_url":"https://github.com/mbugeia","followers_url":"https://api.github.com/users/mbugeia/followers","following_url":"https://api.github.com/users/mbugeia/following{/other_user}","gists_url":"https://api.github.com/users/mbugeia/gists{/gist_id}","starred_url":"https://api.github.com/users/mbugeia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbugeia/subscriptions","organizations_url":"https://api.github.com/users/mbugeia/orgs","repos_url":"https://api.github.com/users/mbugeia/repos","events_url":"https://api.github.com/users/mbugeia/events{/privacy}","received_events_url":"https://api.github.com/users/mbugeia/received_events","type":"User","site_admin":false},"created_at":"2015-10-26T17:04:25Z","updated_at":"2015-10-26T17:04:25Z","body":"Looking at the code the reason seems to be that if a the reverse proxy user doesn't match the session user, the session is closed but kanboard don't automatically try to login with the new reverse proxy user."}}