Possible security bug with sessions?

Question

I asked a while back about supporting multiple sessions (across multiple computers). AFAIK this isn't supported yet since the database still only has one session code per user.

However, I just logged in on my iPhone and the session on my computer is not logged out. I can still write and edit posts on both. The session code in the DB does not match the cookie on my computer (I assume it matches the iPhone cookie but don't think there's a way to check).

It's only a minor thing but thought you'd like to know. (I hope Q2A allows multiple sessions in the future anyway.)

Answer 1

As far as I can remember, you've always been able to log in to your account from multiple places simultaneously. It's just that the "Remember me on this computer" checkbox can only be effective in one browser at a time.

Comments

OK that makes sense, it seems to be tied to sessions so when I close my browser the session ends (unless the checkbox is ticked). It would be nice to be remembered on multiple computers though!

---

On further investigation is seems that what you said in your answer about "remember me" isn't entirely the case. If I log in on one computer with the "remember me" checkbox ticked, it does remember me between sessions, but only until I log in somewhere else. Even with the checkbox unticked on the other computer, it logs me out of the first one.