fix(security): reject multi-worker deployments with unsupported Redis session URIs

Flask-Limiter accepts redis+cluster:// and redis+unix:// storage URIs, but
create_session_store() only recognized redis:// and rediss:// and silently fell
back to per-worker MemorySessionStore. On multi-worker Gunicorn deployments
this broke logout and session rotation: stolen cookies stayed valid on workers
that did not handle the re-login or logout request.

Fail startup when multiple workers are configured with URIs that cannot back
shared sessions, and add redis+unix:// support via the same normalization limits
uses for its Redis storage backend.

Co-authored-by: Alexander Wagner <info@alexanderwagnerdev.com>

Author: cursoragent

config.py

@@ -4,6 +4,8 @@
 import sys
 from datetime import timedelta
 
+from session_store import shared_session_store_supported
+
 _INSECURE_DEFAULTS = frozenset(
     {
         "change-me-to-a-random-value",
@@ -277,13 +279,23 @@ def _validate_config():
         or RATELIMIT_MEMORY_URI
     )
     worker_count = _detect_worker_count()
-    if worker_count > 1 and ratelimit_uri == RATELIMIT_MEMORY_URI:
-        _emit_config_error(
-            f"RATELIMIT_STORAGE_URI={RATELIMIT_MEMORY_URI} is per worker process and bypasses "
-            "login rate limits with multiple Gunicorn workers. Set a shared backend "
-            "(e.g. redis://redis:6379/0) or run with a single worker."
-        )
-        had_error = True
+    if worker_count > 1:
+        if not shared_session_store_supported(ratelimit_uri):
+            if ratelimit_uri == RATELIMIT_MEMORY_URI:
+                _emit_config_error(
+                    f"RATELIMIT_STORAGE_URI={RATELIMIT_MEMORY_URI} is per worker process and "
+                    "bypasses login rate limits with multiple Gunicorn workers. Set a shared "
+                    "backend (e.g. redis://redis:6379/0) or run with a single worker."
+                )
+            else:
+                _emit_config_error(
+                    "RATELIMIT_STORAGE_URI cannot back shared panel sessions across "
+                    "multiple Gunicorn workers. Use redis://, rediss://, or redis+unix://. "
+                    "Schemes such as redis+cluster:// and redis+sentinel:// are supported "
+                    "by the rate limiter only; the panel would otherwise fall back to "
+                    "per-worker in-memory sessions, breaking logout and session rotation."
+                )
+            had_error = True
 
     if _is_insecure_secret(os.environ.get("LRTMP2_API_TOKEN")):
         _emit_config_error(

session_store.py

@@ -6,6 +6,22 @@
 logger = logging.getLogger(__name__)
 
 _REDIS_SCHEMES = frozenset({"redis", "rediss"})
+_REDIS_UNIX_SCHEMES = frozenset({"redis+unix", "valkey+unix"})
+_SHARED_SESSION_SCHEMES = _REDIS_SCHEMES | _REDIS_UNIX_SCHEMES
+
+
+def shared_session_store_supported(storage_uri):
+    """Return True when the URI can back sessions across Gunicorn workers."""
+    return urlparse(storage_uri).scheme in _SHARED_SESSION_SCHEMES
+
+
+def _normalize_redis_url(storage_uri):
+    """Match limits' redis+unix handling so redis.from_url accepts the URI."""
+    scheme = urlparse(storage_uri).scheme
+    if scheme in _REDIS_UNIX_SCHEMES:
+        prefix = scheme.split("+", 1)[0]
+        return storage_uri.replace(f"{prefix}+unix", "unix", 1)
+    return storage_uri
 _REVOKE_SESSION_SCRIPT = """
 local active = redis.call("GET", KEYS[1])
 if active == ARGV[1] then
@@ -67,7 +83,7 @@ def __init__(self, storage_uri):
 
         self._redis_error = redis.exceptions.RedisError
         self._client = redis.from_url(
-            storage_uri,
+            _normalize_redis_url(storage_uri),
             socket_timeout=2,
             socket_connect_timeout=2,
         )
@@ -141,6 +157,6 @@ def revoke(self, username, token):
 
 def create_session_store(storage_uri):
     scheme = urlparse(storage_uri).scheme
-    if scheme in _REDIS_SCHEMES:
+    if scheme in _SHARED_SESSION_SCHEMES:
         return RedisSessionStore(storage_uri)
     return MemorySessionStore()

tests/test_app.py

@@ -345,6 +345,23 @@ def test_config_rejects_memory_ratelimit_with_gunicorn_argv_workers(monkeypatch)
         _forget_config_module()
 
 
+def test_config_rejects_redis_cluster_ratelimit_with_multiple_workers(monkeypatch):
+    monkeypatch.setenv("SECRET_KEY", "valid-test-secret-key-for-redis-cluster-check")
+    monkeypatch.setenv("PASSWORD", "valid-test-password-for-redis-cluster-check")
+    monkeypatch.setenv("LRTMP2_API_TOKEN", "valid-test-api-token-for-redis-cluster-check")
+    monkeypatch.setenv("REQUIRE_LOGIN", "true")
+    monkeypatch.setenv("RATELIMIT_STORAGE_URI", "redis+cluster://redis:6379/0")
+    monkeypatch.setenv("GUNICORN_CMD_ARGS", "--bind=0.0.0.0:8000 --workers=3")
+
+    _forget_config_module()
+    try:
+        with pytest.raises(SystemExit) as exc:
+            importlib.import_module("config")
+        assert exc.value.code == 1
+    finally:
+        _forget_config_module()
+
+
 def test_config_accepts_long_password_when_login_enabled(monkeypatch):
     monkeypatch.setenv("SECRET_KEY", "valid-test-secret-key-for-placeholder-check")
     monkeypatch.setenv("PASSWORD", "valid-test-password-for-placeholder-check")

tests/test_session_store.py

@@ -9,6 +9,7 @@
     RedisSessionStore,
     SessionBackendUnavailable,
     create_session_store,
+    shared_session_store_supported,
 )
 
 
@@ -169,3 +170,23 @@ def test_create_session_store_selects_backend_from_uri_scheme():
     with patch("session_store.RedisSessionStore") as redis_store_cls:
         assert create_session_store("redis://redis:6379/0") is redis_store_cls.return_value
         assert create_session_store("rediss://redis:6379/0") is redis_store_cls.return_value
+        assert create_session_store("redis+unix:///var/run/redis.sock") is redis_store_cls.return_value
+
+
+def test_shared_session_store_supported_rejects_cluster_and_sentinel_uris():
+    assert shared_session_store_supported("redis://redis:6379/0") is True
+    assert shared_session_store_supported("rediss://redis:6379/0") is True
+    assert shared_session_store_supported("redis+unix:///var/run/redis.sock") is True
+    assert shared_session_store_supported("redis+cluster://redis:6379/0") is False
+    assert shared_session_store_supported("redis+sentinel://redis:6379/0") is False
+    assert shared_session_store_supported("memory://") is False
+
+
+def test_redis_store_normalizes_unix_socket_uri():
+    _store, client, redis_module = _make_redis_store("redis+unix:///var/run/redis.sock")
+
+    redis_module.from_url.assert_called_once_with(
+        "unix:///var/run/redis.sock",
+        socket_timeout=2,
+        socket_connect_timeout=2,
+    )