github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-06 03:06:53 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FEATURE: refresh session cookie at most once an hour

Browse Source 
This feature ensures session cookie lifespan is extended
when user is online.

Also decreases session timeout from 90 to 60 days.
Ensures all users (including logged on ones) get expiring sessions.
This commit is contained in:
Sam
2016-07-25 12:07:31 +10:00
parent a9207dafa7
commit df535c6346
9 changed files with 57 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
lib/auth/default_current_user_provider.rb
View File

@ -36,7 +36,10 @@ class Auth::DefaultCurrentUserProvider
current_user = nil
if auth_token && auth_token.length == 32
current_user = User.where(auth_token: auth_token).where('auth_token_created_at IS NULL OR auth_token_created_at > ?', SiteSetting.maximum_session_age.hours.ago).first
current_user = User.where(auth_token: auth_token)
.where('auth_token_updated_at IS NULL OR auth_token_updated_at > ?',
SiteSetting.maximum_session_age.hours.ago)
.first
end
if current_user && (current_user.suspended? || !current_user.active)
@ -61,9 +64,16 @@ class Auth::DefaultCurrentUserProvider
@env[CURRENT_USER_KEY] = current_user
end
def refresh_session(user, session, cookies)
if user && (!user.auth_token_updated_at || user.auth_token_updated_at <= 1.hour.ago)
user.update_column(:auth_token_updated_at, Time.zone.now)
cookies[TOKEN_COOKIE] = { value: user.auth_token, httponly: true, expires: SiteSetting.maximum_session_age.hours.from_now }
end
end
def log_on_user(user, session, cookies)
user.auth_token = SecureRandom.hex(16)
user.auth_token_created_at = Time.zone.now
user.auth_token_updated_at = Time.zone.now
user.save!
cookies[TOKEN_COOKIE] = { value: user.auth_token, httponly: true, expires: SiteSetting.maximum_session_age.hours.from_now }
make_developer_admin(user)