Cookie capturing vulnerability about flask-security-fork HOT 2 CLOSED

Thanks for reporting the issue. We are closing this fork, so it's better if you report it upstream on mattupstate/flask-security

Isn't this issue more a by product of Flask's client side session management than a security issue. E.g. in inveniosoftware/invenio-accounts we're storing sessions server-side (using Flask-KVSessions) and removing the sessions upon logout (or if e.g. an admin deactivates a user), hence if you logout the session can't be reused like you have described.

from flask-security-fork.

@lnielsen Thanks, storing sessions servers-side is something to think about.

I've reported this on flask-security: pallets-eco#665

from flask-security-fork.