auto-login process does not honor session.phishing.protected.attributes property

• Type: Story
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 6.0.6 GA
• Fix Version/s: None
• Component/s: Accessibility, Application Security
• Labels:
  • out-of-scope
• Branch Version/s:
  6.0.x

when logging in via the auto-login hook (i.e. Facebook SSO), session attribute keys defined in session.phishing.protected.attributes are not honored, and so they're not copied from old session to new session.

expected behavior is that these attributes listed by their key in the session.phishing.protected.attributes property should be copied over to the new session post login.