maxcountryman/flask-login — pull request #32 by FelixLoether (2012-08-16 09:53:24+00:00)
Title: Update identifier on confirm_login

When using basic session protection and a user's IP changes or their browser updates, the session is marked non-fresh because their identifier has changed. When the user is reauthorized using `confirm_login` the session is marked fresh, but the identifier isn't updated. This causes the next request to again mark the session non-fresh because the generated identifier still differs from the one stored in the session.

The first commit updates the stored identifier when confirm_login is called, and the second one adds some testing for this problem.