Give all sessions a uniform absolute lifetime of one week

Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.

1 files changed, 1 insertions, 0 deletions

diff --git a/app/controllers/otp_challenges_controller.rb b/app/controllers/otp_challenges_controller.rb
index 892503a8..e31c36ca 100644
--- a/app/controllers/otp_challenges_controller.rb
+++ b/app/controllers/otp_challenges_controller.rb
@@ -27,6 +27,7 @@ class OtpChallengesController < ApplicationController
       return_to = session[:return_to]
       reset_session
       self.current_user = user
+      session[:logged_in_at] = Time.now.to_i
       flash[:notice] = "Logged in successfully"
       redirect_to safe_return_to(return_to, :default => admin_path)
     else