mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 08:13:50 +00:00
Linus Rath
5622eca36b
Used impersonation token ids were only remembered in process memory, so a captured handoff link could be redeemed a second time within its five minute lifetime once the process restarted, or on another replica. Each used id now also leaves a marker file in the state directory, created exclusively, which every replica sharing the state volume sees; markers are pruned once the token could no longer verify. The absolute session limit comes from the eight-hour app password that Stalwart itself expires.