Expire inactive sessions, optionally allow to stay signed in #82

						
				@ -6,1 +6,4 @@

				  connect() {

				    // Devise timeoutable ends up adding a second flash message without content

				    // TODO investigate bug

				    if (this.element.textContent.trim() == "true") return;

bumi commented

2023-02-19 13:17:30 +00:00

so the content has the value "true"?

raucao commented

2023-02-19 14:02:36 +00:00

Yeah, for that unexpected additional flash message. I figured it's OK to hotfix like this, since no message should ever just say "true".

config/initializers/devise.rb Outdated

						
				@ -230,3 +230,3 @@

				  # The time you want to timeout the user session without activity. After this

				  # time the user will be asked for credentials again. Default is 30 minutes.

				  # config.timeout_in = 30.minutes

				  config.timeout_in = 24.hours

bumi commented

2023-02-19 13:24:02 +00:00

I tend to have this number higher these days.

👍 1

raucao commented

2023-02-19 14:04:34 +00:00

What timeout would you propose?

(Keep in mind that this is the central account management app, where you can potentially take over a lot of services if you're able to access an active browser session.)

What timeout would you propose? (Keep in mind that this is the central account management app, where you can potentially take over a lot of services if you're able to access an active browser session.)

raucao commented

2023-03-19 06:41:32 +00:00

@bumi Did you see my question here?

bumi commented

2023-03-19 09:06:30 +00:00

yeah, not sure... it's always the balance between convenience that I don't have to login again and some "security" in case a user uses a "public" computer.

but yeah, leave it to a day. if the user does not visit the site again after a day they have to login again.

yeah, not sure... it's always the balance between convenience that I don't have to login again and some "security" in case a user uses a "public" computer. but yeah, leave it to a day. if the user does not visit the site again after a day they have to login again.

raucao commented

2023-03-19 11:14:01 +00:00

Since I also wasn't quite happy with forcing the tradeoff this way, I have overhauled the sign-in form and added a remember-me button, using our new toggle switch component and Devise's Rememberable strategy. So now it's better both ways: expiring faster when needed, and staying logged in when the user thinks it's safe.

Updated PR description and added a screenshot.

@bumi I'll wait for last review and approval before merging.

Since I also wasn't quite happy with forcing the tradeoff this way, I have overhauled the sign-in form and added a remember-me button, using our new toggle switch component and Devise's Rememberable strategy. So now it's better both ways: expiring faster when needed, and staying logged in when the user thinks it's safe. Updated PR description and added a screenshot. @bumi I'll wait for last review and approval before merging.