sneak
b04bc2cc7b
All checks were successful
check / check (push) Successful in 3m6s
Sessions had only a 7-day absolute lifetime, and that cap was enforced only by the cookie's MaxAge -- i.e. only by the browser. An abandoned session stayed usable for the full week. Sessions are now bounded by two independent, server-enforced clocks, and end at whichever expires first: - absolute: created_at + 7 days, stamped once by SetUser and never rewritten, so no amount of activity can extend it - idle: last_seen + SESSION_IDLE_TIMEOUT (default 24h), pushed forward by the new Session.Touch Both deadlines are checked in Session.expired, which IsAuthenticated now consults, so every existing authentication decision honours them without each call site having to remember. Activity means a request that passes RequireAuth, which is the only place Touch is called; an unauthenticated request carrying the cookie cannot keep a session alive. Touch re-checks authentication itself so that guarantee does not depend on the call site. To avoid re-issuing the session cookie on every authenticated request, Touch rewrites last_seen only once it is older than a tenth of the idle window. The session therefore expires up to 10% early relative to the user's true last request, never late. An authenticated session carrying no timestamps (a cookie minted before this change) is treated as expired, so the failure mode of the upgrade is one forced re-login rather than an unbounded session. Tests use an injected clock rather than sleeps and cover idle expiry, refresh on activity, an actively used session still dying at the absolute cap, refusal to refresh unauthenticated or expired sessions, disabled idle expiry, and startup aborting on an unparseable SESSION_IDLE_TIMEOUT.
5.9 KiB
5.9 KiB