Draft: Expire session from init
Related to #395038 and #432508
What does this MR do and why?
This MR allows admins to configure Gitlab to compute session TTL based on date of session initialization rather than last activity or remember me status.
- Adds setting to toggle "expire from creation" on sessions
- If setting is enabled, prevents further activity or settings from extending the TTL of the session object in redis, instead sets TTL of new session key to be old TTL.
!395038 Other issues request similar support, this is just most in depth
Screenshots or screen recordings
How to set up and validate locally
bin/rails db:migrate
- Enable the
expire_session_from_init
feature flag:/rails/features/
- Navigate to the Admin Area > Settings > General > Account and Limit and enable "expire session from creation" :
/admin/application_settings/general#js-account-settings
- Set the
Session duration (minutes)
to 1 minute, for example. - Create a new user session
- Validate correct TTL for said session
- Perform an action as aforementioned user that would normally extend the session duration
- Validate the session TTL has not been reset and is from the time of original session creation.
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Edited by Eduardo Sanz García