Opened 8 months ago

Last modified 8 months ago

#27775 new Bug

Signed cookies does not support custom expiry

Reported by: Andreas Pelme Owned by: nobody
Component: contrib.sessions Version: 1.10
Severity: Normal Keywords:
Cc: Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: yes
Easy pickings: no UI/UX: no

Description

Calling set_expiry() when using the signed cookies backend does not do anything. This has been known for quite some time, see:

Ticket #19201 already exists that goes into details about problems with session expiration. This ticket exists to track the particular bug that custom expiration does not work in the signed cookies backend.

I propose that we should either (and I would be happy to work to get PR:s for):

  • Raise an explicit exception when set_expiry() is called on signed cookie session backend. Currently the call is just ignored which may lead to security issues if the default configured session timeout is very high and some sensitive login/session need like to have a much lower expiration.

I very much agree with the conclusion in #19201 that expiration is messy across backends and is in need of refactor but I think the current state is even worse where we have silent failures for potentially secret sensitive code.

I don't have the time to work on a full refactor of the expiration (given that it needs to be very backward compatible it is probably a bit of work involved).

Change History (2)

comment:1 Changed 8 months ago by Tim Graham

Triage Stage: UnreviewedAccepted

comment:2 Changed 8 months ago by Tim Graham

Patch needs improvement: set
Note: See TracTickets for help on using tickets.
Back to Top