From d5883869e97244335370d54e21ef46b3f1885899 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 17:20:41 +0200 Subject: Give all sessions a uniform absolute lifetime of one week Enforced at restore via a login-time stamp, written only at genuine logins so the limit stays absolute rather than sliding. The cookie name rotation logs everyone out once at deploy. Second-factor users are deliberately not treated worse than password-only ones. --- config/initializers/session_store.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'config') diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb index 507dc3c4..1835d557 100644 --- a/config/initializers/session_store.rb +++ b/config/initializers/session_store.rb @@ -1 +1 @@ -Cccms::Application.config.session_store :cookie_store, :key => '_cccms_session' +Cccms::Application.config.session_store :cookie_store, :key => '_cccms_session_v2' -- cgit v1.3