{"action":"created","issue":{"url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/5602","repository_url":"https://api.github.com/repos/CenterForOpenScience/osf.io","labels_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/5602/labels{/name}","comments_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/5602/comments","events_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/5602/events","html_url":"https://github.com/CenterForOpenScience/osf.io/pull/5602","id":152881665,"number":5602,"title":"[Feature] Add 30-day Session Timeout for OSF [OSF-6099][SEC-10]","user":{"login":"cslzchen","id":3750414,"avatar_url":"https://avatars.githubusercontent.com/u/3750414?v=3","gravatar_id":"","url":"https://api.github.com/users/cslzchen","html_url":"https://github.com/cslzchen","followers_url":"https://api.github.com/users/cslzchen/followers","following_url":"https://api.github.com/users/cslzchen/following{/other_user}","gists_url":"https://api.github.com/users/cslzchen/gists{/gist_id}","starred_url":"https://api.github.com/users/cslzchen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cslzchen/subscriptions","organizations_url":"https://api.github.com/users/cslzchen/orgs","repos_url":"https://api.github.com/users/cslzchen/repos","events_url":"https://api.github.com/users/cslzchen/events{/privacy}","received_events_url":"https://api.github.com/users/cslzchen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2016-05-03T21:44:06Z","updated_at":"2016-05-16T18:24:54Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/5602","html_url":"https://github.com/CenterForOpenScience/osf.io/pull/5602","diff_url":"https://github.com/CenterForOpenScience/osf.io/pull/5602.diff","patch_url":"https://github.com/CenterForOpenScience/osf.io/pull/5602.patch"},"body":"## Purpose\r\n\r\nOSF does not have a server-side session timeout validation. It relies on two client-side assumptions:\r\n* Browser follows the protocol and removes the cookie when quits/expires\r\n* The cookie is not stolen.\r\n\r\nWe add a server side validation which checks the age of the target session associated with a cookie. User is redirected to CAS if the session is older than 30 days, and the outdated session is removed from our database. Users will be automtically logged in if TGC is still alive.\r\n\r\n## Changes\r\n\r\nThe validation is added to `before_request()` in `framework/sessions/__init__.py`:\r\n\r\n```\r\nif not util_time.throttle_period_expired(session.date_created, settings.COOKIE_TIMEOUT):\r\n    ...\r\nelse\r\n    remove_session(session)\r\n```\r\n\r\n## Side effects\r\n\r\nNo side effects\r\n\r\n## Ticket\r\n\r\n[OSF-6099](https://openscience.atlassian.net/browse/OSF-6099)\r\n[SEC-10](https://openscience.atlassian.net/browse/SEC-10)"},"comment":{"url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/comments/219504435","html_url":"https://github.com/CenterForOpenScience/osf.io/pull/5602#issuecomment-219504435","issue_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/5602","id":219504435,"user":{"login":"cslzchen","id":3750414,"avatar_url":"https://avatars.githubusercontent.com/u/3750414?v=3","gravatar_id":"","url":"https://api.github.com/users/cslzchen","html_url":"https://github.com/cslzchen","followers_url":"https://api.github.com/users/cslzchen/followers","following_url":"https://api.github.com/users/cslzchen/following{/other_user}","gists_url":"https://api.github.com/users/cslzchen/gists{/gist_id}","starred_url":"https://api.github.com/users/cslzchen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cslzchen/subscriptions","organizations_url":"https://api.github.com/users/cslzchen/orgs","repos_url":"https://api.github.com/users/cslzchen/repos","events_url":"https://api.github.com/users/cslzchen/events{/privacy}","received_events_url":"https://api.github.com/users/cslzchen/received_events","type":"User","site_admin":false},"created_at":"2016-05-16T18:24:54Z","updated_at":"2016-05-16T18:24:54Z","body":"Add `assert_in('login', res.location)` as suggested by MattF. Drop to RTM directly."}}