openconnect_clear_cookie()
David Woodhouse
dwmw2 at infradead.org
Fri Oct 10 03:35:13 PDT 2014
On Fri, 2014-10-10 at 11:39 +0200, Nikos Mavrogiannopoulos wrote:
> Hello,
> It seems that openconnect_clear_cookie() only clears the cookie used
> for authentication. Shouldn't that also clear any other cookies sent
> by the server, i.e., call clear_cookies() as well? Otherwise there is
> no other way to clear the server's state and retry.
>
> My use case is a server (ocserv) on which I tried a password which is
> no longer valid. In order to retry a user-provided password I need to
> clear all server's state (e.g., cookies), and there is no way to do
> that as I see. Would it make sense to extend
> openconnect_clear_cookie() for that?
Hm, isn't openconnect_clear_cookie() just one of those semi-pointless
security things to avoid leaving the cookie around in memory after we're
done?
I think what you actually want is openconnect_reset_ssl(), which has
been used for 'reset everything to base state' by the NetorkManager
auth-dialog since the beginning.
--
dwmw2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5745 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20141010/feea3840/attachment-0001.bin>
More information about the openconnect-devel
mailing list