From d5883869e97244335370d54e21ef46b3f1885899 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 17:20:41 +0200 Subject: Give all sessions a uniform absolute lifetime of one week Enforced at restore via a login-time stamp, written only at genuine logins so the limit stays absolute rather than sliding. The cookie name rotation logs everyone out once at deploy. Second-factor users are deliberately not treated worse than password-only ones. --- lib/authenticated_test_helper.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'lib/authenticated_test_helper.rb') diff --git a/lib/authenticated_test_helper.rb b/lib/authenticated_test_helper.rb index c0ec5f40..8f3a3732 100644 --- a/lib/authenticated_test_helper.rb +++ b/lib/authenticated_test_helper.rb @@ -2,5 +2,6 @@ module AuthenticatedTestHelper # Sets the current user in the session from the user fixtures. def login_as(user) @request.session[:user_id] = user ? users(user).id : nil - end + @request.session[:logged_in_at] = Time.now.to_i + end end -- cgit v1.3