fix: CookieStore MaxAge value (#2485) #2488
Merged
Conversation
CookieStore MaxAge is set to 86400 * 30 by default. This prevents secure cookies retrieval with expiration > 30 days. MaxAge: 0 disables MaxAge check by SecureCookie, thus allowing sessions lasting > 30 days.
|
|
romanlytvyn
changed the title
|
Awesome, thank you for your contribution! This looks pretty good and I have some ideas how to improve it further :) |
1 task
mitar
added a commit
to mitar/hydra
that referenced
this pull request
May 13, 2021
CookieStore MaxAge is set to 86400 * 30 by default. This prevents secure cookies retrieval with expiration > 30 days. MaxAge: 0 disables MaxAge check by SecureCookie, thus allowing sessions lasting > 30 days. Closes ory#2485 Co-authored-by: hackerman <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Related issue
Solves #2485
Proposed changes
Set
CookieStoreMaxAgeoption to0during initialization.CookieStore MaxAge is set to 86400 * 30 by default.
This prevents secure cookies retrieval with expiration > 30 days.
MaxAge: 0 disables MaxAge check by SecureCookie, thus allowing sessions lasting > 30 days.
Checklist
vulnerability. If this pull request addresses a security. vulnerability, I
confirm that I got green light (please contact
[email protected]) from the maintainers to push
the changes.
works.
Further comments
MaxAgecan be made configurable, not sure if it's useful though.Setting
MaxAgeto any non-zero value puts a hard cap over sessionremember_forfunctionality.