Give all sessions a uniform absolute lifetime of one week

Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.

1 files changed, 2 insertions, 0 deletions

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index f0d5cf9b..49d33810 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -29,6 +29,8 @@ class SessionsController < ApplicationController
         redirect_to new_otp_challenge_path
       else
         self.current_user = user
+        session[:logged_in_at] = Time.now.to_i
+
         if user.otp_required?
           flash[:error] = "Your account requires a second factor -- set it up now."
           redirect_to edit_user_path(user)