kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-12 20:15:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): refuse peer cache files that name types other than datetime

Browse Source 
The server and the client both check a forwarded cache file before they write it, because Cacher decodes it with jsonpickle. The session-create cache write now runs off the event loop.
This commit is contained in:
imSp4rky
2026-10-20 19:48:13 -06:00
parent 08a2257be3
commit 5b9120a7f1
6 changed files with 141 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/dev/rest-api/remote-sessions.md
+2 -1
View File
@@ -398,7 +398,8 @@ serve:
cannot read each other's cached tokens. The server deletes the directory when the
remote session ends. A remote session that uses a server account (`serve.server_accounts`)
gets a persistent per-account cache instead, so the account's tokens outlive the
remote session.
remote session. The server and the client both refuse a forwarded cache file that is not
JSON or that names a type other than a date or time, and the service then authenticates again.
- **The server redacts secrets in logs.** It redacts remote session IDs, service tags,
and other user values before it writes them to the log.