Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Fix #4058 - Use a long-lived cookie to keep track of user-level sessions (#4091)

Browse source 
* Fix #4058 - Use a long-lived cookie to keep track of user-level sessions

* Fix tests, smooth migrate from previous session-based identifier
This commit is contained in:
Eugen Rochko 2017-07-07 23:25:15 +02:00 • committed by GitHub
parent 7a549f830e
commit 00df69bc89
3 changed files with 25 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

20
config/initializers/devise.rb
View file

@ -1,17 +1,29 @@
Warden::Manager.after_set_user except: :fetch do |user, warden|
SessionActivation.deactivate warden.raw_session['auth_id']
warden.raw_session['auth_id'] = user.activate_session(warden.request)
SessionActivation.deactivate warden.cookies.signed['_session_id']
warden.cookies.signed['_session_id'] = {
value: user.activate_session(warden.request),
expires: 1.year.from_now,
httponly: true,
}
end
Warden::Manager.after_fetch do |user, warden|
unless user.session_active?(warden.raw_session['auth_id'])
if user.session_active?(warden.cookies.signed['_session_id'] || warden.raw_session['auth_id'])
warden.cookies.signed['_session_id'] = {
value: warden.cookies.signed['_session_id'] || warden.raw_session['auth_id'],
expires: 1.year.from_now,
httponly: true,
}
else
warden.logout
throw :warden, message: :unauthenticated
end
end
Warden::Manager.before_logout do |_, warden|
SessionActivation.deactivate warden.raw_session['auth_id']
SessionActivation.deactivate warden.cookies.signed['_session_id']
warden.cookies.delete('_session_id')
end
Devise.setup do |config|