From d5883869e97244335370d54e21ef46b3f1885899 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 17:20:41 +0200 Subject: Give all sessions a uniform absolute lifetime of one week Enforced at restore via a login-time stamp, written only at genuine logins so the limit stays absolute rather than sliding. The cookie name rotation logs everyone out once at deploy. Second-factor users are deliberately not treated worse than password-only ones. --- lib/authenticated_system.rb | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'lib/authenticated_system.rb') diff --git a/lib/authenticated_system.rb b/lib/authenticated_system.rb index 7accfaaa..2ec15a77 100644 --- a/lib/authenticated_system.rb +++ b/lib/authenticated_system.rb @@ -1,4 +1,6 @@ module AuthenticatedSystem + SESSION_MAX_AGE = 7.days + protected # Returns true or false if the user is logged in. # Preloads @current_user with the user model if they're logged in. @@ -98,7 +100,12 @@ module AuthenticatedSystem # Called from #current_user. First attempt to login by the user id stored in the session. def login_from_session - self.current_user = User.find_by_id(session[:user_id]) if session[:user_id] + return unless session[:user_id] + if session[:logged_in_at].to_i > SESSION_MAX_AGE.ago.to_i + self.current_user = User.find_by(:id => session[:user_id]) + else + session[:user_id] = nil + end end # -- cgit v1.3