From d5883869e97244335370d54e21ef46b3f1885899 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 17:20:41 +0200 Subject: Give all sessions a uniform absolute lifetime of one week Enforced at restore via a login-time stamp, written only at genuine logins so the limit stays absolute rather than sliding. The cookie name rotation logs everyone out once at deploy. Second-factor users are deliberately not treated worse than password-only ones. --- test/controllers/sessions_controller_test.rb | 1 + 1 file changed, 1 insertion(+) (limited to 'test/controllers/sessions_controller_test.rb') diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb index 62acd28a..86da0e61 100644 --- a/test/controllers/sessions_controller_test.rb +++ b/test/controllers/sessions_controller_test.rb @@ -9,6 +9,7 @@ class SessionsControllerTest < ActionController::TestCase post :create, params: { login: 'quentin', password: 'monkey' } assert session[:user_id] assert_response :redirect + assert session[:logged_in_at].present? end def test_should_fail_login_and_not_redirect -- cgit v1.3