Configurable session expiration

02e65ff1765181682be301334616a5a8caff2523

Cohee <18619528+Cohee1207@users.noreply.github.com>

default/config.yaml+5 -0 Viewed

   formality: default
 # -- SERVER PLUGIN CONFIGURATION --
 enableServerPlugins: false
 +# User session timeout *in seconds* (defaults to 24 hours).
 +## Set to a positive number to expire session after a certain time of inactivity
 +## Set to 0 to expire session when the browser is closed
 +## Set to a negative number to disable session expiration
 +sessionTimeout: 86400

server.js+20 -1 Viewed

     });
+}
 +function getSessionCookieAge() {
 +    // Defaults to 24 hours in seconds if not set
 +    const configValue = getConfigValue('sessionTimeout', 24 * 60 * 60);
++
 +    // Convert to milliseconds
 +    if (configValue > 0) {
 +        return configValue * 1000;
 +    }
++
 +    // "No expiration" is just 400 days as per RFC 6265
 +    if (configValue < 0) {
 +        return 400 * 24 * 60 * 60 * 1000;
 +    }
++
 +    // 0 means session cookie is deleted when the browser session ends
 +    // (depends on the implementation of the browser)
 +    return undefined;
 +}
++
 app.use(cookieSession({
     name: userModule.getCookieSessionName(),
     sameSite: 'strict',
     httpOnly: true,
 -    maxAge: 24 * 60 * 60 * 1000, // 24 hours
 +    maxAge: getSessionCookieAge(),
     secret: userModule.getCookieSecret(),
 }));