id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37423	File-based sessions remain accessible after integer expiry	Sarah Boyce	Sarah Boyce	"The file-based session backend does not enforce the server-side expiry time when `SessionBase.set_expiry()` is called with a positive integer.
A session can still be loaded using its session ID after the configured timeout has elapsed. `clearsessions` also leaves the expired file in place.

For example, with the file-based backend:

{{{#!python
from django.contrib.sessions.backends.file import SessionStore
import time

session = SessionStore()
session[""foo""] = ""bar""
session.set_expiry(1)
session.save()
session_key = session.session_key

time.sleep(2)

SessionStore(session_key).get(""foo"")  # Returns ""bar""; expected None.
}}}

`set_expiry(1)` stores the integer `1` in `_session_expiry`. The file backend passes that value to `get_expiry_age()`, which returns `1` without comparing it with the file’s last modification time. The session therefore remains accessible server-side.

The backend should calculate the expiry date using the stored timeout and the file’s last modification time.

----
This had been reported to the security team by Chris Griffin. The security team has agreed to treat this a security hardening in public. 
I recommend that we backport to 5.2.
This was then later reported publicly by Patel Namraa, who is now in cc."	Bug	assigned	contrib.sessions	5.2	Release blocker		not-security	Patel Namraa Chris Griffin	Unreviewed	1	0	0	0	0	0