romshark / datapages / 36191421046

push

github

fix: End streams at session expiry

A client, including one using a stolen cookie, could open a stream
before ExpiresAt and keep receiving events after the session expired.
Only applications setting `NewSession.ExpiresAt` are affected.

Stores may not delete expired sessions until a later request or
`DeleteExpired` call, so closure notifications cannot enforce expiry.

9 of 16 new or added lines in 8 files covered. (56.25%)

14238 of 35720 relevant lines covered (39.86%)

34.34 hits per line