Give all sessions a uniform absolute lifetime of one week

Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.

2 files changed, 3 insertions, 0 deletions

diff --git a/app/controllers/otp_challenges_controller.rb b/app/controllers/otp_challenges_controller.rb
index 892503a8..e31c36ca 100644
--- a/app/controllers/otp_challenges_controller.rb
+++ b/app/controllers/otp_challenges_controller.rb
@@ -27,6 +27,7 @@ class OtpChallengesController < ApplicationController
       return_to = session[:return_to]
       reset_session
       self.current_user = user
+      session[:logged_in_at] = Time.now.to_i
       flash[:notice] = "Logged in successfully"
       redirect_to safe_return_to(return_to, :default => admin_path)
     else
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index f0d5cf9b..49d33810 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -29,6 +29,8 @@ class SessionsController < ApplicationController
         redirect_to new_otp_challenge_path
       else
         self.current_user = user
+        session[:logged_in_at] = Time.now.to_i
+
         if user.otp_required?
           flash[:error] = "Your account requires a second factor -- set it up now."
           redirect_to edit_user_path(user)