From d5883869e97244335370d54e21ef46b3f1885899 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 17:20:41 +0200 Subject: Give all sessions a uniform absolute lifetime of one week Enforced at restore via a login-time stamp, written only at genuine logins so the limit stays absolute rather than sliding. The cookie name rotation logs everyone out once at deploy. Second-factor users are deliberately not treated worse than password-only ones. --- app/controllers/sessions_controller.rb | 2 ++ 1 file changed, 2 insertions(+) (limited to 'app/controllers/sessions_controller.rb') diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb index f0d5cf9b..49d33810 100644 --- a/app/controllers/sessions_controller.rb +++ b/app/controllers/sessions_controller.rb @@ -29,6 +29,8 @@ class SessionsController < ApplicationController redirect_to new_otp_challenge_path else self.current_user = user + session[:logged_in_at] = Time.now.to_i + if user.otp_required? flash[:error] = "Your account requires a second factor -- set it up now." redirect_to edit_user_path(user) -- cgit v1.3