1

As Stack Overflow was one of the sites affected by Heartbleed, and it is fixed now:

How is it possible that after re-issuing certificates, my account is still logged in? It must be invalidated and log me out.

As mentioned in this post:

Heartbleed means:

  • Invalidating all session keys and cookies

Am I missing something? Or are my cookies not getting invalidated?

Improve this question
5
  • 3
    Read starting from this comment
    – 3ventic
    Apr 10, 2014 at 18:24
  • What OpenID provider are you using? And SSL certificates != login session.
    – Martijn Pieters
    Apr 10, 2014 at 18:24
  • Keep in mind that if SO invalidated your login session, but your openID provider didn't, then SO would ask your openID provider to authenticate and it could be doing so based on a cached session. This makes you appear to stay logged in, as a user, even though you logged out and back in from SE's perspective.
    – Servy
    Apr 10, 2014 at 18:32
  • I think they were only vulnerable on the blog site; all SE sites run on windows servers which don't use OpenSSL.
    – user1228
    Apr 10, 2014 at 18:32
  • 2
    @Won't the SSL terminates at haproxy, which was vulnerable. It did affect all the sites. That's why they reissued all the certificates.
    – Steven V
    Apr 10, 2014 at 18:38

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .