Give all sessions a uniform absolute lifetime of one week

Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.

1 files changed, 8 insertions, 1 deletions

diff --git a/lib/authenticated_system.rb b/lib/authenticated_system.rb
index 7accfaaa..2ec15a77 100644
--- a/lib/authenticated_system.rb
+++ b/lib/authenticated_system.rb
@@ -1,4 +1,6 @@
 module AuthenticatedSystem
+  SESSION_MAX_AGE = 7.days
+
   protected
     # Returns true or false if the user is logged in.
     # Preloads @current_user with the user model if they're logged in.
@@ -98,7 +100,12 @@ module AuthenticatedSystem
 
     # Called from #current_user.  First attempt to login by the user id stored in the session.
     def login_from_session
-      self.current_user = User.find_by_id(session[:user_id]) if session[:user_id]
+      return unless session[:user_id]
+      if session[:logged_in_at].to_i > SESSION_MAX_AGE.ago.to_i
+        self.current_user = User.find_by(:id => session[:user_id])
+      else
+        session[:user_id] = nil
+      end
     end
     
     #