Review feedback on #560 (DrDoof):
- A login that came with a cookie that is still valid took a second
slot. The first one looked fresh, so the next login could push out
someone who is using the switch. The slot of the cookie now gets the
new id.
- Changing the password leaves no old login valid: session_init() from
parse_passwd(). With one session the next login pushed a leftover one
out, with several it would stay valid until the next restart.
- The 32-bit comparison of the last use times moves into a leaf function,
so the compiler does not give it a 4-byte scratch in internal RAM.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The web server's bank had no room left for the four sessions once the
original firmware's more robust header handling came in. Picking a slot,
checking a cookie and starting a session move to sessions.c in bank 3;
httpd.c only calls session_init(), session_check() and session_new().
The random id is written straight into the reply, which drops
gen_random_hex_chars() from bank 1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Brunoz78andClaude Sonnet 5.5