Skip to content

Include additional unique user information in session

Created by: ElizabethStirling

Due to potential security concerns raised in this ops incident, we want to store the creation date of the user in as part of the session stored in Redis. To do this, we would update cmd/frontend/internal/session/session.go:sessionInfo to contain a field UserCreatedAt that would be compared with the user's creation date whenever the session was used to authenticate. Since this would only be out of sync due to a serious issue, we should alert if this check fails, since it indicates that either sessions are users are being improperly generated or used.

Relates to the incident in #16629