simple-login/app
1
1
Fork 0
mirror of https://github.com/simple-login/app.git synced 2025-09-29 01:46:49 +08:00
Code Issues Projects Releases Packages Wiki Activity

For unauthenticated sessions only store them in redis for 5m (#1345)

Browse source 
Co-authored-by: Adrià Casajús <adria.casajus@proton.ch>
This commit is contained in:
Adrià Casajús 2022-10-13 15:55:08 +02:00 • committed by GitHub
parent d5ca316e41
commit 72277211bb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
app/session.py
View file

@ -88,10 +88,15 @@ class RedisSessionStore(SessionInterface):
secure = self.get_cookie_secure(app)
expires = self.get_expiration_time(app, session)
val = pickle.dumps(dict(session))
ttl = int(app.permanent_session_lifetime.total_seconds())
# Only 5 minutes for non-authenticated sessions.
# We need to keep the non-authenticated ones because the csrf token is stored in the session.
if "_user_id" not in session:
ttl = 300
self._redis_w.setex(
name=self._get_key(session.session_id),
value=val,
time=int(app.permanent_session_lifetime.total_seconds()),
time=ttl,
)
signed_session_id = self._get_signer(app).sign(
itsdangerous.want_bytes(session.session_id)