Skip to content

[mgt] Remove LOGIN_SESSION_TIMEOUT from the m Cookie (backport #16894)#16929

Merged
MarcialRosales merged 2 commits into
v4.3.xfrom
mergify/bp/v4.3.x/pr-16894
Jul 13, 2026
Merged

[mgt] Remove LOGIN_SESSION_TIMEOUT from the m Cookie (backport #16894)#16929
MarcialRosales merged 2 commits into
v4.3.xfrom
mergify/bp/v4.3.x/pr-16894

Conversation

@mergify

@mergify mergify Bot commented Jul 13, 2026

Copy link
Copy Markdown

Proposed Changes

Remove unnecessary pseudo-cookie (entry stored within the m cookie) .
This change is part of an effort of securing cookies. All cookies that exists in the management ui are now owned by the server and fully secured with the right attributes. The only cookie left is m, controlled by the client side, which only exists for the pseudo-cookie LOGGED_IN which has a TTL that controls the lifespan of the client-side session. This cookie has no value hence it is fine that it is not fully secured because javascript created cookies cannot be fully secured.
Also, this pseudo-cookie needs to be accessed by javascript hence it cannot be owned by the server.

Types of Changes

What types of changes does your code introduce to this project?
Put an x in the boxes that apply

  • Bug fix (non-breaking change which fixes issue #NNNN)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause an observable behavior change in existing systems)
  • Documentation improvements (corrections, new content, etc)
  • Cosmetic change (whitespace, formatting, etc)
  • Build system and/or CI

This is an automatic backport of pull request #16894 done by [Mergify](https://mergify.com).

MarcialRosales and others added 2 commits July 13, 2026 06:47
@mergify

mergify Bot commented Jul 13, 2026

Copy link
Copy Markdown
Author

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@MarcialRosales MarcialRosales merged commit 7386b13 into v4.3.x Jul 13, 2026
187 checks passed
@MarcialRosales MarcialRosales deleted the mergify/bp/v4.3.x/pr-16894 branch July 13, 2026 13:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants