Ylianst/MeshCentralRouter

MC Router logging in with no password!!!

Closed this issue · 3 comments

vitko-bg commented

So to recreate the issue you can do the following:

  1. Log in to MC
  2. Download and install MC Router
  3. Close newly installed MC Router
  4. Start MC Router from MC by "Router"->"Launch MC Router"
  5. MC Router opens and logging in automatically, which is fine as MC webpage is open and I believe session is live.
  6. Keep MC Router open, and log out from the MC Web Page.
  7. Logout from MC Router.
  8. Now, when clicking on Login on MC Router with and empty password, it is logging in without any problems.
    I already kept MC Router open for a good couple of hours without logging in to MC via any browser, and still can login with no password .............
Ylianst commented

Your right, I did not clear the login cookie on logout. Working on a fix now. Also, the login cookie given to MeshCentral Router was valid for 4 hours, but I will be dropping that to 1 hour in the next MeshCentral version.

Ylianst commented

Just published MeshCentral v0.6.39 with a fix for this. It was not a server issue, but the router did not clear credentials and the server would generate a 4 hour cookie. In the fix, the router now clears the credentials on logout and cookies it now 1 hour. Let me know if this works.

Ylianst commented

Closing this one as it's been fixed. Please open again if needed.