Skip to content

Draft: Expire session from init

Related to #395038 and #432508

What does this MR do and why?

This MR allows admins to configure Gitlab to compute session TTL based on date of session initialization rather than last activity or remember me status.

  • Adds setting to toggle "expire from creation" on sessions
  • If setting is enabled, prevents further activity or settings from extending the TTL of the session object in redis, instead sets TTL of new session key to be old TTL.

!395038 Other issues request similar support, this is just most in depth

Screenshots or screen recordings

image

How to set up and validate locally

  1. bin/rails db:migrate
  2. Enable the expire_session_from_init feature flag: /rails/features/
  3. Navigate to the Admin Area > Settings > General > Account and Limit and enable "expire session from creation" : /admin/application_settings/general#js-account-settings
  4. Set the Session duration (minutes) to 1 minute, for example.
  5. Create a new user session
  6. Validate correct TTL for said session
  7. Perform an action as aforementioned user that would normally extend the session duration
  8. Validate the session TTL has not been reset and is from the time of original session creation.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Eduardo Sanz García

Merge request reports

Loading