FriendsOfSymfony/FOSOAuthServerBundle — pull request #35 by ludofleury (2012-04-18 23:23:18+00:00)
Title: Fixes session security issue

According to the Session documentation, the invalidate method expect one parameter _($lifetime, integer)_

> Sets the cookie lifetime for the session cookie. A null value will leave the system settings unchanged, 0 sets the cookie to expire with browser session. Time is in seconds, and is not a Unix timestamp.

With the current implementation, calling `->invalidate()` will keep the session alive until the browser is closed. Even if the /authorize action is a redirection, a malicious user could exploit this breach.