Stale sessions never re-sync privileges from Authelia (revoked admin keeps access up to 5h) #56

New Issue

2026-08-31T21:40:09-04:00

jared commented

2026-08-31 21:40:09 -04:00

Severity: High

middleware/AuthMiddleware.php (~lines 79-98), authenticate() — Remote-Groups (and thus is_admin, via UserModel::syncUserFromAuthelia) is only re-read/re-synced when $_SESSION['user'] doesn't exist yet. Once a session exists, every subsequent request only checks the idle timer (last_activity vs SESSION_TIMEOUT, default 18000s/5h) — it never re-validates against current Authelia/LLDAP state.

Impact: If an admin's admin group membership is revoked in LLDAP, or Authelia logs them out at the proxy, their already-open PHP session keeps is_admin=true and full access for up to 5 hours (or until browser close, since cookie_lifetime=0), with no way to force early revocation short of clearing PHP's server-side session store.

Fix: Periodically re-validate Remote-Groups/Remote-User against the session's cached values (e.g. every N minutes, or on every admin-gated request at minimum) and re-sync or invalidate the session on mismatch, not just on session absence.

**Severity:** High `middleware/AuthMiddleware.php` (~lines 79-98), `authenticate()` — `Remote-Groups` (and thus `is_admin`, via `UserModel::syncUserFromAuthelia`) is only re-read/re-synced when `$_SESSION['user']` doesn't exist yet. Once a session exists, every subsequent request only checks the idle timer (`last_activity` vs `SESSION_TIMEOUT`, default 18000s/5h) — it never re-validates against current Authelia/LLDAP state. **Impact:** If an admin's `admin` group membership is revoked in LLDAP, or Authelia logs them out at the proxy, their already-open PHP session keeps `is_admin=true` and full access for up to 5 hours (or until browser close, since `cookie_lifetime=0`), with no way to force early revocation short of clearing PHP's server-side session store. **Fix:** Periodically re-validate `Remote-Groups`/`Remote-User` against the session's cached values (e.g. every N minutes, or on every admin-gated request at minimum) and re-sync or invalidate the session on mismatch, not just on session absence.

jared added the priority/high security labels 2026-09-08 10:15:46 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#56