Give all sessions a uniform absolute lifetime of one week

Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.

7 files changed, 28 insertions, 3 deletions

diff --git a/app/controllers/otp_challenges_controller.rb b/app/controllers/otp_challenges_controller.rb
index 892503a8..e31c36ca 100644
--- a/app/controllers/otp_challenges_controller.rb
+++ b/app/controllers/otp_challenges_controller.rb
@@ -27,6 +27,7 @@ class OtpChallengesController < ApplicationController
       return_to = session[:return_to]
       reset_session
       self.current_user = user
+      session[:logged_in_at] = Time.now.to_i
       flash[:notice] = "Logged in successfully"
       redirect_to safe_return_to(return_to, :default => admin_path)
     else
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index f0d5cf9b..49d33810 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -29,6 +29,8 @@ class SessionsController < ApplicationController
         redirect_to new_otp_challenge_path
       else
         self.current_user = user
+        session[:logged_in_at] = Time.now.to_i
+
         if user.otp_required?
           flash[:error] = "Your account requires a second factor -- set it up now."
           redirect_to edit_user_path(user)
diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
index 507dc3c4..1835d557 100644
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -1 +1 @@
-Cccms::Application.config.session_store :cookie_store, :key => '_cccms_session'
+Cccms::Application.config.session_store :cookie_store, :key => '_cccms_session_v2'
diff --git a/lib/authenticated_system.rb b/lib/authenticated_system.rb
index 7accfaaa..2ec15a77 100644
--- a/lib/authenticated_system.rb
+++ b/lib/authenticated_system.rb
@@ -1,4 +1,6 @@
 module AuthenticatedSystem
+  SESSION_MAX_AGE = 7.days
+
   protected
     # Returns true or false if the user is logged in.
     # Preloads @current_user with the user model if they're logged in.
@@ -98,7 +100,12 @@ module AuthenticatedSystem
 
     # Called from #current_user.  First attempt to login by the user id stored in the session.
     def login_from_session
-      self.current_user = User.find_by_id(session[:user_id]) if session[:user_id]
+      return unless session[:user_id]
+      if session[:logged_in_at].to_i > SESSION_MAX_AGE.ago.to_i
+        self.current_user = User.find_by(:id => session[:user_id])
+      else
+        session[:user_id] = nil
+      end
     end
     
     #
diff --git a/lib/authenticated_test_helper.rb b/lib/authenticated_test_helper.rb
index c0ec5f40..8f3a3732 100644
--- a/lib/authenticated_test_helper.rb
+++ b/lib/authenticated_test_helper.rb
@@ -2,5 +2,6 @@ module AuthenticatedTestHelper
   # Sets the current user in the session from the user fixtures.
   def login_as(user)
     @request.session[:user_id] = user ? users(user).id : nil
-  end  
+    @request.session[:logged_in_at] = Time.now.to_i
+  end
 end
diff --git a/test/controllers/admin_controller_test.rb b/test/controllers/admin_controller_test.rb
index a177851f..9747d8e9 100644
--- a/test/controllers/admin_controller_test.rb
+++ b/test/controllers/admin_controller_test.rb
@@ -45,4 +45,17 @@ class AdminControllerTest < ActionController::TestCase
     get :index
     assert_redirected_to edit_user_path(users(:quentin))
   end
+
+  test "a session older than the absolute limit is rejected" do
+    login_as :quentin
+    @request.session[:logged_in_at] = (AuthenticatedSystem::SESSION_MAX_AGE.ago - 1.day).to_i
+    get :index
+    assert_response :redirect
+  end
+
+  test "a fresh session carries the login stamp" do
+    login_as :quentin
+    get :index
+    assert_response :success
+  end
 end
diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb
index 62acd28a..86da0e61 100644
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -9,6 +9,7 @@ class SessionsControllerTest < ActionController::TestCase
     post :create, params: { login: 'quentin', password: 'monkey' }
     assert session[:user_id]
     assert_response :redirect
+    assert session[:logged_in_at].present?
   end
 
   def test_should_fail_login_and_not_redirect