From d5883869e97244335370d54e21ef46b3f1885899 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 17:20:41 +0200 Subject: Give all sessions a uniform absolute lifetime of one week Enforced at restore via a login-time stamp, written only at genuine logins so the limit stays absolute rather than sliding. The cookie name rotation logs everyone out once at deploy. Second-factor users are deliberately not treated worse than password-only ones. --- app/controllers/otp_challenges_controller.rb | 1 + app/controllers/sessions_controller.rb | 2 ++ config/initializers/session_store.rb | 2 +- lib/authenticated_system.rb | 9 ++++++++- lib/authenticated_test_helper.rb | 3 ++- test/controllers/admin_controller_test.rb | 13 +++++++++++++ test/controllers/sessions_controller_test.rb | 1 + 7 files changed, 28 insertions(+), 3 deletions(-) diff --git a/app/controllers/otp_challenges_controller.rb b/app/controllers/otp_challenges_controller.rb index 892503a8..e31c36ca 100644 --- a/app/controllers/otp_challenges_controller.rb +++ b/app/controllers/otp_challenges_controller.rb @@ -27,6 +27,7 @@ class OtpChallengesController < ApplicationController return_to = session[:return_to] reset_session self.current_user = user + session[:logged_in_at] = Time.now.to_i flash[:notice] = "Logged in successfully" redirect_to safe_return_to(return_to, :default => admin_path) else diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb index f0d5cf9b..49d33810 100644 --- a/app/controllers/sessions_controller.rb +++ b/app/controllers/sessions_controller.rb @@ -29,6 +29,8 @@ class SessionsController < ApplicationController redirect_to new_otp_challenge_path else self.current_user = user + session[:logged_in_at] = Time.now.to_i + if user.otp_required? flash[:error] = "Your account requires a second factor -- set it up now." redirect_to edit_user_path(user) diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb index 507dc3c4..1835d557 100644 --- a/config/initializers/session_store.rb +++ b/config/initializers/session_store.rb @@ -1 +1 @@ -Cccms::Application.config.session_store :cookie_store, :key => '_cccms_session' +Cccms::Application.config.session_store :cookie_store, :key => '_cccms_session_v2' diff --git a/lib/authenticated_system.rb b/lib/authenticated_system.rb index 7accfaaa..2ec15a77 100644 --- a/lib/authenticated_system.rb +++ b/lib/authenticated_system.rb @@ -1,4 +1,6 @@ module AuthenticatedSystem + SESSION_MAX_AGE = 7.days + protected # Returns true or false if the user is logged in. # Preloads @current_user with the user model if they're logged in. @@ -98,7 +100,12 @@ module AuthenticatedSystem # Called from #current_user. First attempt to login by the user id stored in the session. def login_from_session - self.current_user = User.find_by_id(session[:user_id]) if session[:user_id] + return unless session[:user_id] + if session[:logged_in_at].to_i > SESSION_MAX_AGE.ago.to_i + self.current_user = User.find_by(:id => session[:user_id]) + else + session[:user_id] = nil + end end # diff --git a/lib/authenticated_test_helper.rb b/lib/authenticated_test_helper.rb index c0ec5f40..8f3a3732 100644 --- a/lib/authenticated_test_helper.rb +++ b/lib/authenticated_test_helper.rb @@ -2,5 +2,6 @@ module AuthenticatedTestHelper # Sets the current user in the session from the user fixtures. def login_as(user) @request.session[:user_id] = user ? users(user).id : nil - end + @request.session[:logged_in_at] = Time.now.to_i + end end diff --git a/test/controllers/admin_controller_test.rb b/test/controllers/admin_controller_test.rb index a177851f..9747d8e9 100644 --- a/test/controllers/admin_controller_test.rb +++ b/test/controllers/admin_controller_test.rb @@ -45,4 +45,17 @@ class AdminControllerTest < ActionController::TestCase get :index assert_redirected_to edit_user_path(users(:quentin)) end + + test "a session older than the absolute limit is rejected" do + login_as :quentin + @request.session[:logged_in_at] = (AuthenticatedSystem::SESSION_MAX_AGE.ago - 1.day).to_i + get :index + assert_response :redirect + end + + test "a fresh session carries the login stamp" do + login_as :quentin + get :index + assert_response :success + end end diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb index 62acd28a..86da0e61 100644 --- a/test/controllers/sessions_controller_test.rb +++ b/test/controllers/sessions_controller_test.rb @@ -9,6 +9,7 @@ class SessionsControllerTest < ActionController::TestCase post :create, params: { login: 'quentin', password: 'monkey' } assert session[:user_id] assert_response :redirect + assert session[:logged_in_at].present? end def test_should_fail_login_and_not_redirect -- cgit v1.3