{"action":"created","issue":{"url":"https://api.github.com/repos/apache/couchdb-couch/issues/194","repository_url":"https://api.github.com/repos/apache/couchdb-couch","labels_url":"https://api.github.com/repos/apache/couchdb-couch/issues/194/labels{/name}","comments_url":"https://api.github.com/repos/apache/couchdb-couch/issues/194/comments","events_url":"https://api.github.com/repos/apache/couchdb-couch/issues/194/events","html_url":"https://github.com/apache/couchdb-couch/pull/194","id":174752808,"number":194,"title":"Trigger cookie renewal on /_session","user":{"login":"adrienverge","id":5244945,"avatar_url":"https://avatars.githubusercontent.com/u/5244945?v=3","gravatar_id":"","url":"https://api.github.com/users/adrienverge","html_url":"https://github.com/adrienverge","followers_url":"https://api.github.com/users/adrienverge/followers","following_url":"https://api.github.com/users/adrienverge/following{/other_user}","gists_url":"https://api.github.com/users/adrienverge/gists{/gist_id}","starred_url":"https://api.github.com/users/adrienverge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adrienverge/subscriptions","organizations_url":"https://api.github.com/users/adrienverge/orgs","repos_url":"https://api.github.com/users/adrienverge/repos","events_url":"https://api.github.com/users/adrienverge/events{/privacy}","received_events_url":"https://api.github.com/users/adrienverge/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-09-02T12:52:41Z","updated_at":"2016-09-02T13:20:39Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/apache/couchdb-couch/pulls/194","html_url":"https://github.com/apache/couchdb-couch/pull/194","diff_url":"https://github.com/apache/couchdb-couch/pull/194.diff","patch_url":"https://github.com/apache/couchdb-couch/pull/194.patch"},"body":"It is currently not possible to programmatically renew an `AuthSession` cookie. The only way is to wait 10% of the cookie expiration time then make any request to CouchDB, so it sends a new cookie.\r\n\r\nProgrammatically getting cookies can be needed, for example, when passwords are managed by authentication server. E.g., a third-party auth server gets a cookie, forwards it to a user, and the user needs the CouchDB server to install a new cookie in his/her browser with a `Set-Cookie` header. (Browsers don't allow JS to install cookies, only a `Set-Cookie` header from the server can set the cookie.)\r\n\r\nThis patch brings the following change: an already-authenticated request (either POST or GET) on `/_session` will trigger the creation of a new cookie, whatever we're inside the 10% timeout window or not.  This way, applications can programmatically get a cookie without having to wait 60 seconds.\r\n\r\nThis closes: COUCHDB-3125"},"comment":{"url":"https://api.github.com/repos/apache/couchdb-couch/issues/comments/244372694","html_url":"https://github.com/apache/couchdb-couch/pull/194#issuecomment-244372694","issue_url":"https://api.github.com/repos/apache/couchdb-couch/issues/194","id":244372694,"user":{"login":"rnewson","id":47223,"avatar_url":"https://avatars.githubusercontent.com/u/47223?v=3","gravatar_id":"","url":"https://api.github.com/users/rnewson","html_url":"https://github.com/rnewson","followers_url":"https://api.github.com/users/rnewson/followers","following_url":"https://api.github.com/users/rnewson/following{/other_user}","gists_url":"https://api.github.com/users/rnewson/gists{/gist_id}","starred_url":"https://api.github.com/users/rnewson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rnewson/subscriptions","organizations_url":"https://api.github.com/users/rnewson/orgs","repos_url":"https://api.github.com/users/rnewson/repos","events_url":"https://api.github.com/users/rnewson/events{/privacy}","received_events_url":"https://api.github.com/users/rnewson/received_events","type":"User","site_admin":false},"created_at":"2016-09-02T13:20:39Z","updated_at":"2016-09-02T13:20:39Z","body":"I think it's already a problem that a cookie can be extended indefinitely (sure, it's invalidated by a password change but I don't think everyone realises that they only expire through inactivity).\r\n\r\nThe patch itself is close to 'done', see my previous comments.\r\n\r\ntbh I would rather not merge this, and also remove the 10% renewal thing as well; forcing users to re-authenticate at least once per couch_httpd_auth timeout period. That's a larger conversation, and a controversial one, and definitely a post 2.0 thing, but I think many administrators expect cookies to expire after that timeout regardless of activity.\r\n\r\nI don't want to discourage you from contributing, you've done a great job in your first patch. Authentication is a gnarly corner and CouchDB's auth system is fiddly in its own right.\r\n\r\nA way forward, post 2.0, is a conversation about sessions and particularly about permanent sessions. We might support new authentication methods, like token authentication, to deal with this situation."}}
{"actor":{"display_login":"rnewson"}}