From d5883869e97244335370d54e21ef46b3f1885899 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 17:20:41 +0200 Subject: Give all sessions a uniform absolute lifetime of one week Enforced at restore via a login-time stamp, written only at genuine logins so the limit stays absolute rather than sliding. The cookie name rotation logs everyone out once at deploy. Second-factor users are deliberately not treated worse than password-only ones. --- app/controllers/otp_challenges_controller.rb | 1 + app/controllers/sessions_controller.rb | 2 ++ 2 files changed, 3 insertions(+) (limited to 'app') diff --git a/app/controllers/otp_challenges_controller.rb b/app/controllers/otp_challenges_controller.rb index 892503a8..e31c36ca 100644 --- a/app/controllers/otp_challenges_controller.rb +++ b/app/controllers/otp_challenges_controller.rb @@ -27,6 +27,7 @@ class OtpChallengesController < ApplicationController return_to = session[:return_to] reset_session self.current_user = user + session[:logged_in_at] = Time.now.to_i flash[:notice] = "Logged in successfully" redirect_to safe_return_to(return_to, :default => admin_path) else diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb index f0d5cf9b..49d33810 100644 --- a/app/controllers/sessions_controller.rb +++ b/app/controllers/sessions_controller.rb @@ -29,6 +29,8 @@ class SessionsController < ApplicationController redirect_to new_otp_challenge_path else self.current_user = user + session[:logged_in_at] = Time.now.to_i + if user.otp_required? flash[:error] = "Your account requires a second factor -- set it up now." redirect_to edit_user_path(user) -- cgit v1.3