User deletion/updates are not immediatly reflected on currently logged-in users

[pine3ree]

When a user is authenticated both her/his identity and roles are stored in the session. Subsequent requests will check for any active session first, so, even if the user was deleted or updated with more restricted roles, as long as the session stays active, the user can operate with old permissions (the user snapshot at login time) (Think of a rude forum member)

mezzio-authentication-session/src/PhpSession.php

Line 122 in c0e1e94

$userInfo = $session->get(UserInterface::class);

Sessions can also survive browser close/reopen operation if the browser is configured to remember session cookies when the session lifetime is not set to be very short.

I have always used a different approach: I store just the identity (id/username/email) of the user in the session and reload the user details/permission from the storage (db) on every request.

kind regards