From d5883869e97244335370d54e21ef46b3f1885899 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 17:20:41 +0200 Subject: Give all sessions a uniform absolute lifetime of one week Enforced at restore via a login-time stamp, written only at genuine logins so the limit stays absolute rather than sliding. The cookie name rotation logs everyone out once at deploy. Second-factor users are deliberately not treated worse than password-only ones. --- test/controllers/admin_controller_test.rb | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'test/controllers/admin_controller_test.rb') diff --git a/test/controllers/admin_controller_test.rb b/test/controllers/admin_controller_test.rb index a177851f..9747d8e9 100644 --- a/test/controllers/admin_controller_test.rb +++ b/test/controllers/admin_controller_test.rb @@ -45,4 +45,17 @@ class AdminControllerTest < ActionController::TestCase get :index assert_redirected_to edit_user_path(users(:quentin)) end + + test "a session older than the absolute limit is rejected" do + login_as :quentin + @request.session[:logged_in_at] = (AuthenticatedSystem::SESSION_MAX_AGE.ago - 1.day).to_i + get :index + assert_response :redirect + end + + test "a fresh session carries the login stamp" do + login_as :quentin + get :index + assert_response :success + end end -- cgit v1.3