fix(server): non-fatal UA session binding + sliding session renewal - #727
Merged
Conversation
Two root causes behind users being logged out: - UA session binding was unconditional and fatal — any User-Agent change (browser/WebView update, DevTools device emulation, mobile rebuild) silently de-authenticated the session. Now log-only across all three enforcement sites (TokenAuth, SessionAuth, and the validateSessionCookie helper used by CLI-auth/account/session-check routes), mirroring the default IP-change handling. (BUG-1815) - Sessions had a fixed absolute TTL with no refresh on activity, so even an active user hit the cliff at 7d (web) / 30d (CLI). Adds sliding renewal: RenewSessionIfStale extends expires_at when past the half-window threshold, capped at created_at + 90d (SessionMaxLifetime), CAS-guarded and only reported when RowsAffected confirms the write. The middleware re-issues the session + CSRF cookies on renewal. New renew_ttl_seconds column (sqlite + pg migrations); legacy rows (0) keep their fixed expiry. (TASK-1816) Reviewed by Codex (clean). Tests: store + server suites pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Users were being logged out frequently on web and the mobile app. Two server-side root causes:
What
TokenAuth,SessionAuth, and thevalidateSessionCookiehelper (CLI-auth approval, account/2FA setup, session check) — so auth semantics don't split between middleware- and helper-protected routes.RenewSessionIfStaleextendsexpires_atwhen a session is past its half-window threshold, capped atcreated_at + 90d(SessionMaxLifetime). CAS-guarded; only reported as renewed whenRowsAffected()confirms the write.SessionAuth/TokenAuthre-issue the session (+CSRF) cookie on renewal.renew_ttl_secondscolumn (sqlite migration 067 + pg 046). Legacy rows (0) keep their fixed expiry and age out.Tracking
BUG-1815, TASK-1816.
Verification
go build ./...,go test ./internal/store/ ./internal/server/pass (4 new renewal tests).