[6.x] Add config for disabling Elevated Sessions#14464
[6.x] Add config for disabling Elevated Sessions#14464jasonvarga merged 11 commits intostatamic:6.xfrom
Conversation
1stevengrant
changed the title
jasonvarga
left a comment
jasonvarga
left a comment
There was a problem hiding this comment.
Opting out of a security feature like this feels awkward.
How are you implementing OAuth on your site? It might make sense if the Elevated Session page allowed you to re-authenticate however you authenticated in the first place.
That might be a big rabbit hole though. It'll probably end up better to just allow a way to disable it in the end, but I'd still like to know.
In any case, could you change it to elevated_sessions_enabled (with true as the default) as having disabled: true always feels backwards.
|
We use Auth0 to authenticate via OTP. There's a customised login screen hosted with them and then we have a success callback that handles Laravel auth. We never login via the control panel. Works fine currently with v5. |
|
Fair enough. Yeah let's just flip the config to be |
|
Pausing this until #14424 is done. |
# Conflicts: # src/Http/Middleware/CP/RequireElevatedSession.php
Matches the existing singular elevated_session_duration and elevated_session_url keys. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Also exposes the flag to JS so the requireElevatedSession helper short-circuits before hitting the (now absent) status endpoint. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Feature-level boolean reads better as plural. Kept elevated_session_duration singular since "duration of a session" is semantically about one session. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
3 participants
Summary
elevated_sessions_enabledconfig option toconfig/users.phpthat allows disabling elevated sessions entirelySTATAMIC_ELEVATED_SESSIONS_ENABLED=falsein your.envfile.RequireElevatedSessionmiddleware is bypassed, so users are never prompted to reauthorizeContext
Our Statamic implementation uses Auth0 as the primary auth driver, which means elevated sessions (password re-confirmation) are not applicable since authentication is handled externally. This config option allows us (and others using OAuth providers) to cleanly disable the feature.
References: