aboutsummaryrefslogtreecommitdiffstats
path: root/lib/private/User/Session.php
diff options
context:
space:
mode:
Diffstat (limited to 'lib/private/User/Session.php')
-rw-r--r--lib/private/User/Session.php317
1 files changed, 173 insertions, 144 deletions
diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
index 365a01c4595..e7bfcf56407 100644
--- a/lib/private/User/Session.php
+++ b/lib/private/User/Session.php
@@ -1,70 +1,46 @@
<?php
+
/**
- * @copyright Copyright (c) 2017, Sandro Lutz <sandro.lutz@temparus.ch>
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
- * @author Bernhard Posselt <dev@bernhard-posselt.com>
- * @author Bjoern Schiessle <bjoern@schiessle.org>
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Felix Rupp <github@felixrupp.com>
- * @author Greta Doci <gretadoci@gmail.com>
- * @author Joas Schilling <coding@schilljs.com>
- * @author Jörn Friedrich Dreyer <jfd@butonic.de>
- * @author Lionel Elie Mamane <lionel@mamane.lu>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Robin Appelman <robin@icewind.nl>
- * @author Robin McCorkell <robin@mccorkell.me.uk>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author Sandro Lutz <sandro.lutz@temparus.ch>
- * @author Thomas Müller <thomas.mueller@tmit.eu>
- * @author Vincent Petry <vincent@nextcloud.com>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2017 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\User;
use OC;
-use OC\Authentication\Exceptions\ExpiredTokenException;
-use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Exceptions\PasswordlessTokenException;
use OC\Authentication\Exceptions\PasswordLoginForbiddenException;
use OC\Authentication\Token\IProvider;
use OC\Authentication\Token\IToken;
+use OC\Authentication\Token\PublicKeyToken;
+use OC\Authentication\TwoFactorAuth\Manager as TwoFactorAuthManager;
use OC\Hooks\Emitter;
use OC\Hooks\PublicEmitter;
+use OC\Security\CSRF\CsrfTokenManager;
use OC_User;
use OC_Util;
use OCA\DAV\Connector\Sabre\Auth;
+use OCP\AppFramework\Db\TTransactional;
use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\Authentication\Exceptions\ExpiredTokenException;
+use OCP\Authentication\Exceptions\InvalidTokenException;
+use OCP\EventDispatcher\GenericEvent;
use OCP\EventDispatcher\IEventDispatcher;
use OCP\Files\NotPermittedException;
use OCP\IConfig;
+use OCP\IDBConnection;
use OCP\IRequest;
use OCP\ISession;
use OCP\IUser;
use OCP\IUserSession;
use OCP\Lockdown\ILockdownManager;
+use OCP\Security\Bruteforce\IThrottler;
use OCP\Security\ISecureRandom;
use OCP\Session\Exceptions\SessionNotAvailableException;
use OCP\User\Events\PostLoginEvent;
+use OCP\User\Events\UserFirstTimeLoggedInEvent;
use OCP\Util;
use Psr\Log\LoggerInterface;
-use Symfony\Component\EventDispatcher\GenericEvent;
/**
* Class Session
@@ -89,54 +65,22 @@ use Symfony\Component\EventDispatcher\GenericEvent;
* @package OC\User
*/
class Session implements IUserSession, Emitter {
-
- /** @var Manager|PublicEmitter $manager */
- private $manager;
-
- /** @var ISession $session */
- private $session;
-
- /** @var ITimeFactory */
- private $timeFactory;
-
- /** @var IProvider */
- private $tokenProvider;
-
- /** @var IConfig */
- private $config;
+ use TTransactional;
/** @var User $activeUser */
protected $activeUser;
- /** @var ISecureRandom */
- private $random;
-
- /** @var ILockdownManager */
- private $lockdownManager;
-
- private LoggerInterface $logger;
- /** @var IEventDispatcher */
- private $dispatcher;
-
- public function __construct(Manager $manager,
- ISession $session,
- ITimeFactory $timeFactory,
- ?IProvider $tokenProvider,
- IConfig $config,
- ISecureRandom $random,
- ILockdownManager $lockdownManager,
- LoggerInterface $logger,
- IEventDispatcher $dispatcher
+ public function __construct(
+ private Manager $manager,
+ private ISession $session,
+ private ITimeFactory $timeFactory,
+ private ?IProvider $tokenProvider,
+ private IConfig $config,
+ private ISecureRandom $random,
+ private ILockdownManager $lockdownManager,
+ private LoggerInterface $logger,
+ private IEventDispatcher $dispatcher,
) {
- $this->manager = $manager;
- $this->session = $session;
- $this->timeFactory = $timeFactory;
- $this->tokenProvider = $tokenProvider;
- $this->config = $config;
- $this->random = $random;
- $this->lockdownManager = $lockdownManager;
- $this->logger = $logger;
- $this->dispatcher = $dispatcher;
}
/**
@@ -160,7 +104,7 @@ class Session implements IUserSession, Emitter {
* @param string $method optional
* @param callable $callback optional
*/
- public function removeListener($scope = null, $method = null, callable $callback = null) {
+ public function removeListener($scope = null, $method = null, ?callable $callback = null) {
$this->manager->removeListener($scope, $method, $callback);
}
@@ -210,6 +154,15 @@ class Session implements IUserSession, Emitter {
}
/**
+ * Temporarily set the currently active user without persisting in the session
+ *
+ * @param IUser|null $user
+ */
+ public function setVolatileActiveUser(?IUser $user): void {
+ $this->activeUser = $user;
+ }
+
+ /**
* get the current active user
*
* @return IUser|null Current user, otherwise null
@@ -288,9 +241,9 @@ class Session implements IUserSession, Emitter {
}
/**
- * get the login name of the current user
+ * Get the login name of the current user
*
- * @return string
+ * @return ?string
*/
public function getLoginName() {
if ($this->activeUser) {
@@ -366,12 +319,13 @@ class Session implements IUserSession, Emitter {
if (!$user->isEnabled()) {
// disabled users can not log in
// injecting l10n does not work - there is a circular dependency between session and \OCP\L10N\IFactory
- $message = \OC::$server->getL10N('lib')->t('User disabled');
- throw new LoginException($message);
+ $message = \OCP\Util::getL10N('lib')->t('Account disabled');
+ throw new DisabledUserException($message);
}
if ($regenerateSessionId) {
$this->session->regenerateId();
+ $this->session->remove(Auth::DAV_AUTHENTICATED);
}
$this->setUser($user);
@@ -381,6 +335,7 @@ class Session implements IUserSession, Emitter {
if ($isToken) {
$this->setToken($loginDetails['token']->getId());
$this->lockdownManager->setToken($loginDetails['token']);
+ $user->updateLastLoginTimestamp();
$firstTimeLogin = false;
} else {
$this->setToken(null);
@@ -404,7 +359,7 @@ class Session implements IUserSession, Emitter {
return true;
}
- $message = \OC::$server->getL10N('lib')->t('Login canceled by app');
+ $message = \OCP\Util::getL10N('lib')->t('Login canceled by app');
throw new LoginException($message);
}
@@ -417,16 +372,17 @@ class Session implements IUserSession, Emitter {
* @param string $user
* @param string $password
* @param IRequest $request
- * @param OC\Security\Bruteforce\Throttler $throttler
+ * @param IThrottler $throttler
* @throws LoginException
* @throws PasswordLoginForbiddenException
* @return boolean
*/
public function logClientIn($user,
- $password,
- IRequest $request,
- OC\Security\Bruteforce\Throttler $throttler) {
- $currentDelay = $throttler->sleepDelay($request->getRemoteAddress(), 'login');
+ $password,
+ IRequest $request,
+ IThrottler $throttler) {
+ $remoteAddress = $request->getRemoteAddress();
+ $currentDelay = $throttler->sleepDelayOrThrowOnMax($remoteAddress, 'login');
if ($this->manager instanceof PublicEmitter) {
$this->manager->emit('\OC\User', 'preLogin', [$user, $password]);
@@ -448,19 +404,24 @@ class Session implements IUserSession, Emitter {
// Try to login with this username and password
if (!$this->login($user, $password)) {
-
// Failed, maybe the user used their email address
- $users = $this->manager->getByEmail($user);
- if (!(\count($users) === 1 && $this->login($users[0]->getUID(), $password))) {
- $this->logger->warning('Login failed: \'' . $user . '\' (Remote IP: \'' . \OC::$server->getRequest()->getRemoteAddress() . '\')', ['app' => 'core']);
-
- $throttler->registerAttempt('login', $request->getRemoteAddress(), ['user' => $user]);
+ if (!filter_var($user, FILTER_VALIDATE_EMAIL)) {
+ $this->handleLoginFailed($throttler, $currentDelay, $remoteAddress, $user, $password);
+ return false;
+ }
- $this->dispatcher->dispatchTyped(new OC\Authentication\Events\LoginFailed($user));
+ if ($isTokenPassword) {
+ $dbToken = $this->tokenProvider->getToken($password);
+ $userFromToken = $this->manager->get($dbToken->getUID());
+ $isValidEmailLogin = $userFromToken->getEMailAddress() === $user
+ && $this->validateTokenLoginName($userFromToken->getEMailAddress(), $dbToken);
+ } else {
+ $users = $this->manager->getByEmail($user);
+ $isValidEmailLogin = (\count($users) === 1 && $this->login($users[0]->getUID(), $password));
+ }
- if ($currentDelay === 0) {
- $throttler->sleepDelay($request->getRemoteAddress(), 'login');
- }
+ if (!$isValidEmailLogin) {
+ $this->handleLoginFailed($throttler, $currentDelay, $remoteAddress, $user, $password);
return false;
}
}
@@ -475,6 +436,17 @@ class Session implements IUserSession, Emitter {
return true;
}
+ private function handleLoginFailed(IThrottler $throttler, int $currentDelay, string $remoteAddress, string $user, ?string $password) {
+ $this->logger->warning("Login failed: '" . $user . "' (Remote IP: '" . $remoteAddress . "')", ['app' => 'core']);
+
+ $throttler->registerAttempt('login', $remoteAddress, ['user' => $user]);
+ $this->dispatcher->dispatchTyped(new OC\Authentication\Events\LoginFailed($user, $password));
+
+ if ($currentDelay === 0) {
+ $throttler->sleepDelayOrThrowOnMax($remoteAddress, 'login');
+ }
+ }
+
protected function supportsCookies(IRequest $request) {
if (!is_null($request->getCookie('cookie_test'))) {
return true;
@@ -483,8 +455,8 @@ class Session implements IUserSession, Emitter {
return false;
}
- private function isTokenAuthEnforced() {
- return $this->config->getSystemValue('token_auth_enforced', false);
+ private function isTokenAuthEnforced(): bool {
+ return $this->config->getSystemValueBool('token_auth_enforced', false);
}
protected function isTwoFactorEnforced($username) {
@@ -505,7 +477,7 @@ class Session implements IUserSession, Emitter {
$user = $users[0];
}
// DI not possible due to cyclic dependencies :'-/
- return OC::$server->getTwoFactorAuthManager()->isTwoFactorAuthenticated($user);
+ return OC::$server->get(TwoFactorAuthManager::class)->isTwoFactorAuthenticated($user);
}
/**
@@ -533,7 +505,7 @@ class Session implements IUserSession, Emitter {
if ($refreshCsrfToken) {
// TODO: mock/inject/use non-static
// Refresh the token
- \OC::$server->getCsrfTokenManager()->refreshToken();
+ \OC::$server->get(CsrfTokenManager::class)->refreshToken();
}
if ($firstTimeLogin) {
@@ -553,7 +525,8 @@ class Session implements IUserSession, Emitter {
}
// trigger any other initialization
- \OC::$server->getEventDispatcher()->dispatch(IUser::class . '::firstLogin', new GenericEvent($this->getUser()));
+ \OC::$server->get(IEventDispatcher::class)->dispatch(IUser::class . '::firstLogin', new GenericEvent($this->getUser()));
+ \OC::$server->get(IEventDispatcher::class)->dispatchTyped(new UserFirstTimeLoggedInEvent($this->getUser()));
}
}
@@ -562,11 +535,11 @@ class Session implements IUserSession, Emitter {
*
* @todo do not allow basic auth if the user is 2FA enforced
* @param IRequest $request
- * @param OC\Security\Bruteforce\Throttler $throttler
+ * @param IThrottler $throttler
* @return boolean if the login was successful
*/
public function tryBasicAuthLogin(IRequest $request,
- OC\Security\Bruteforce\Throttler $throttler) {
+ IThrottler $throttler) {
if (!empty($request->server['PHP_AUTH_USER']) && !empty($request->server['PHP_AUTH_PW'])) {
try {
if ($this->logClientIn($request->server['PHP_AUTH_USER'], $request->server['PHP_AUTH_PW'], $request, $throttler)) {
@@ -669,13 +642,15 @@ class Session implements IUserSession, Emitter {
// User does not exist
return false;
}
- $name = isset($request->server['HTTP_USER_AGENT']) ? utf8_encode($request->server['HTTP_USER_AGENT']) : 'unknown browser';
+ $name = isset($request->server['HTTP_USER_AGENT']) ? mb_convert_encoding($request->server['HTTP_USER_AGENT'], 'UTF-8', 'ISO-8859-1') : 'unknown browser';
try {
$sessionId = $this->session->getId();
$pwd = $this->getPassword($password);
// Make sure the current sessionId has no leftover tokens
- $this->tokenProvider->invalidateToken($sessionId);
- $this->tokenProvider->generateToken($sessionId, $uid, $loginName, $pwd, $name, IToken::TEMPORARY_TOKEN, $remember);
+ $this->atomic(function () use ($sessionId, $uid, $loginName, $pwd, $name, $remember) {
+ $this->tokenProvider->invalidateToken($sessionId);
+ $this->tokenProvider->generateToken($sessionId, $uid, $loginName, $pwd, $name, IToken::TEMPORARY_TOKEN, $remember);
+ }, \OCP\Server::get(IDBConnection::class));
return true;
} catch (SessionNotAvailableException $ex) {
// This can happen with OCC, where a memory session is used
@@ -737,8 +712,6 @@ class Session implements IUserSession, Emitter {
return false;
}
- $dbToken->setLastCheck($now);
- $this->tokenProvider->updateToken($dbToken);
return true;
}
@@ -756,6 +729,9 @@ class Session implements IUserSession, Emitter {
}
$dbToken->setLastCheck($now);
+ if ($dbToken instanceof PublicKeyToken) {
+ $dbToken->setLastActivity($now);
+ }
$this->tokenProvider->updateToken($dbToken);
return true;
}
@@ -773,23 +749,23 @@ class Session implements IUserSession, Emitter {
try {
$dbToken = $this->tokenProvider->getToken($token);
} catch (InvalidTokenException $ex) {
+ $this->logger->debug('Session token is invalid because it does not exist', [
+ 'app' => 'core',
+ 'user' => $user,
+ 'exception' => $ex,
+ ]);
return false;
}
- // Check if login names match
- if (!is_null($user) && $dbToken->getLoginName() !== $user) {
- // TODO: this makes it impossible to use different login names on browser and client
- // e.g. login by e-mail 'user@example.com' on browser for generating the token will not
- // allow to use the client token with the login name 'user'.
- $this->logger->error('App token login name does not match', [
- 'tokenLoginName' => $dbToken->getLoginName(),
- 'sessionLoginName' => $user,
- ]);
-
+ if (!is_null($user) && !$this->validateTokenLoginName($user, $dbToken)) {
return false;
}
if (!$this->checkTokenCredentials($dbToken, $token)) {
+ $this->logger->warning('Session token credentials are invalid', [
+ 'app' => 'core',
+ 'user' => $user,
+ ]);
return false;
}
@@ -802,6 +778,27 @@ class Session implements IUserSession, Emitter {
}
/**
+ * Check if login names match
+ */
+ private function validateTokenLoginName(?string $loginName, IToken $token): bool {
+ if (mb_strtolower($token->getLoginName()) !== mb_strtolower($loginName ?? '')) {
+ // TODO: this makes it impossible to use different login names on browser and client
+ // e.g. login by e-mail 'user@example.com' on browser for generating the token will not
+ // allow to use the client token with the login name 'user'.
+ $this->logger->error('App token login name does not match', [
+ 'tokenLoginName' => $token->getLoginName(),
+ 'sessionLoginName' => $loginName,
+ 'app' => 'core',
+ 'user' => $token->getUID(),
+ ]);
+
+ return false;
+ }
+
+ return true;
+ }
+
+ /**
* Tries to login the user with auth token header
*
* @param IRequest $request
@@ -810,15 +807,18 @@ class Session implements IUserSession, Emitter {
*/
public function tryTokenLogin(IRequest $request) {
$authHeader = $request->getHeader('Authorization');
- if (strpos($authHeader, 'Bearer ') === 0) {
+ if (str_starts_with($authHeader, 'Bearer ')) {
$token = substr($authHeader, 7);
- } else {
- // No auth header, let's try session id
+ } elseif ($request->getCookie($this->config->getSystemValueString('instanceid')) !== null) {
+ // No auth header, let's try session id, but only if this is an existing
+ // session and the request has a session cookie
try {
$token = $this->session->getId();
} catch (SessionNotAvailableException $ex) {
return false;
}
+ } else {
+ return false;
}
if (!$this->loginWithToken($token)) {
@@ -835,9 +835,8 @@ class Session implements IUserSession, Emitter {
return true;
}
- // Remember me tokens are not app_passwords
- if ($dbToken->getRemember() === IToken::DO_NOT_REMEMBER) {
- // Set the session variable so we know this is an app password
+ // Set the session variable so we know this is an app password
+ if ($dbToken instanceof PublicKeyToken && $dbToken->getType() === IToken::PERMANENT_TOKEN) {
$this->session->set('app_password', $token);
}
@@ -865,20 +864,41 @@ class Session implements IUserSession, Emitter {
$tokens = $this->config->getUserKeys($uid, 'login_token');
// test cookies token against stored tokens
if (!in_array($currentToken, $tokens, true)) {
+ $this->logger->info('Tried to log in but could not verify token', [
+ 'app' => 'core',
+ 'user' => $uid,
+ ]);
return false;
}
// replace successfully used token with a new one
$this->config->deleteUserValue($uid, 'login_token', $currentToken);
$newToken = $this->random->generate(32);
- $this->config->setUserValue($uid, 'login_token', $newToken, $this->timeFactory->getTime());
+ $this->config->setUserValue($uid, 'login_token', $newToken, (string)$this->timeFactory->getTime());
+ $this->logger->debug('Remember-me token replaced', [
+ 'app' => 'core',
+ 'user' => $uid,
+ ]);
try {
$sessionId = $this->session->getId();
$token = $this->tokenProvider->renewSessionToken($oldSessionId, $sessionId);
+ $this->logger->debug('Session token replaced', [
+ 'app' => 'core',
+ 'user' => $uid,
+ ]);
} catch (SessionNotAvailableException $ex) {
+ $this->logger->critical('Could not renew session token for {uid} because the session is unavailable', [
+ 'app' => 'core',
+ 'uid' => $uid,
+ 'user' => $uid,
+ ]);
return false;
} catch (InvalidTokenException $ex) {
- $this->logger->warning('Renewing session token failed', ['app' => 'core']);
+ $this->logger->error('Renewing session token failed: ' . $ex->getMessage(), [
+ 'app' => 'core',
+ 'user' => $uid,
+ 'exception' => $ex,
+ ]);
return false;
}
@@ -905,7 +925,7 @@ class Session implements IUserSession, Emitter {
*/
public function createRememberMeToken(IUser $user) {
$token = $this->random->generate(32);
- $this->config->setUserValue($user->getUID(), 'login_token', $token, $this->timeFactory->getTime());
+ $this->config->setUserValue($user->getUID(), 'login_token', $token, (string)$this->timeFactory->getTime());
$this->setMagicInCookie($user->getUID(), $token);
}
@@ -917,10 +937,17 @@ class Session implements IUserSession, Emitter {
$this->manager->emit('\OC\User', 'logout', [$user]);
if ($user !== null) {
try {
- $this->tokenProvider->invalidateToken($this->session->getId());
+ $token = $this->session->getId();
+ $this->tokenProvider->invalidateToken($token);
+ $this->logger->debug('Session token invalidated before logout', [
+ 'user' => $user->getUID(),
+ ]);
} catch (SessionNotAvailableException $ex) {
}
}
+ $this->logger->debug('Logging out', [
+ 'user' => $user === null ? null : $user->getUID(),
+ ]);
$this->setUser(null);
$this->setLoginName(null);
$this->setToken(null);
@@ -941,14 +968,15 @@ class Session implements IUserSession, Emitter {
if ($webRoot === '') {
$webRoot = '/';
}
+ $domain = $this->config->getSystemValueString('cookie_domain');
- $maxAge = $this->config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
+ $maxAge = $this->config->getSystemValueInt('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
\OC\Http\CookieHelper::setCookie(
'nc_username',
$username,
$maxAge,
$webRoot,
- '',
+ $domain,
$secureCookie,
true,
\OC\Http\CookieHelper::SAMESITE_LAX
@@ -958,7 +986,7 @@ class Session implements IUserSession, Emitter {
$token,
$maxAge,
$webRoot,
- '',
+ $domain,
$secureCookie,
true,
\OC\Http\CookieHelper::SAMESITE_LAX
@@ -969,7 +997,7 @@ class Session implements IUserSession, Emitter {
$this->session->getId(),
$maxAge,
$webRoot,
- '',
+ $domain,
$secureCookie,
true,
\OC\Http\CookieHelper::SAMESITE_LAX
@@ -985,18 +1013,19 @@ class Session implements IUserSession, Emitter {
public function unsetMagicInCookie() {
//TODO: DI for cookies and IRequest
$secureCookie = OC::$server->getRequest()->getServerProtocol() === 'https';
+ $domain = $this->config->getSystemValueString('cookie_domain');
unset($_COOKIE['nc_username']); //TODO: DI
unset($_COOKIE['nc_token']);
unset($_COOKIE['nc_session_id']);
- setcookie('nc_username', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, '', $secureCookie, true);
- setcookie('nc_token', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, '', $secureCookie, true);
- setcookie('nc_session_id', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, '', $secureCookie, true);
+ setcookie('nc_username', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, $domain, $secureCookie, true);
+ setcookie('nc_token', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, $domain, $secureCookie, true);
+ setcookie('nc_session_id', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, $domain, $secureCookie, true);
// old cookies might be stored under /webroot/ instead of /webroot
// and Firefox doesn't like it!
- setcookie('nc_username', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
- setcookie('nc_token', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
- setcookie('nc_session_id', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
+ setcookie('nc_username', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', $domain, $secureCookie, true);
+ setcookie('nc_token', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', $domain, $secureCookie, true);
+ setcookie('nc_session_id', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', $domain, $secureCookie, true);
}
/**
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-15 08:07:30 +0000