Session handling: api and webdav requests with basic auth or oauth2 tokens shall not start a session

[DeepDiver1975]

Reasoning:

• sessions are only usefull in web ui
• webdav by itself does not specify the use of sessions - only basic auth
• plain dav requests (e.g. caldav and carddav) are stateless and have no sessions - thousands of new sessions are generated - totally pointless Faulty session handling (creating massive amount of sessions when webdav-interface is in use) - workaround #5383

What to do:

• sessions are only started when an explicit login via the webui is initiated
• information currently being stored in the session needs to be store in a different location
• analyse the information which is stored in the session and review the storage location
• ISession and IUserSession are part of the public api - we need to continue to support this

[PVince81]

What about web UI?

[ownclouders]

GitMate.io thinks the contributor most likely able to help you is @PVince81.

[DeepDiver1975]

sessions are only started when an explicit login via the webui is initiated

[PVince81]

moving to planned

[PVince81]

backlog

[DeepDiver1975]

We will not touch these parts anymore -> close