SVN client credential cache persistence after authz revocation in mod_dav_svn
0 reputation · 20 Mar 2020, 22:18 UTC
Goal
Determine whether an SVN 1.14 client using mod_dav_svn with an LDAP authentication provider will immediately enforce a newly revoked authz rule for a user whose credentials are still cached locally.
Constraints and uncertainty
The SVN client caches username/password (or token) credentials for the duration of the session or until the cache expires. Server‑side permission changes are evaluated per request, but it is unclear if the client’s cached credentials cause the server to skip re‑evaluation of authz rules, potentially allowing stale access until the cache is cleared or times out.
Questions:
- Does the SVN client bypass server‑side
authzre‑check when presenting cached credentials? - If bypass occurs, what is the exact condition (credential type, authentication protocol) that triggers it?
- How can the behavior be observed without clearing the cache manually?