File-based sessions remain accessible after integer expiry

[Sarah Boyce]

The file-based session backend does not enforce the server-side expiry time when SessionBase.set_expiry() is called with a positive integer.
A session can still be loaded using its session ID after the configured timeout has elapsed. clearsessions also leaves the expired file in place.

For example, with the file-based backend:

from django.contrib.sessions.backends.file import SessionStore
import time

session = SessionStore()
session["foo"] = "bar"
session.set_expiry(1)
session.save()
session_key = session.session_key

time.sleep(2)

SessionStore(session_key).get("foo")  # Returns "bar"; expected None.

set_expiry(1) stores the integer 1 in _session_expiry. The file backend passes that value to get_expiry_age(), which returns 1 without comparing it with the file’s last modification time. The session therefore remains accessible server-side.

The backend should calculate the expiry date using the stored timeout and the file’s last modification time.

---

This had been reported to the security team by Chris Griffin. The security team has agreed to treat this a security hardening in public.
I recommend that we backport to 5.2.
This was then later reported publicly by Patel Namraa, who is now in cc.