actix / actix/actix-extras

conditionally set visit/login deadlines per login

Open
#266 1 comment 1 reaction 0 assignees View on GitHub
A-identity C-feature
Dominant language
Rust
Stars
889
Forks
224
Avg merge
9h 37m
Merged PRs (30d)
20

Description

It's fairly common for login pages to have a "keep me logged in" option. I'd love a way to do this with `actix_identity`.

Maybe a `Identity::login_with_deadline` function that would overwrite any visit/login deadline set in `IdentityMiddleware`? This seems difficult with the current setup, but maybe fields for per-user deadlines could be added to `Identity`? Then the existing `enabled` flags could be replaced with `Option` which is either a `Copy` of the `Duration` in `IdentityMiddleware` or a custom one, and that's what gets checked to see if a user should be logged out (not sure if that's even possible).

Probably easier would be to provide methods to access the `visit/login_deadline_enabled` fields on a given identity, but to achieve the "keep logged in functionality" you'd basically just have to choose between no deadline and a short auto-logout one (ideally we could keep a default deadline even if users choose to be kept logged in).

Would love to hear what others think!

Contributor guide

Open the contributing guide

Research direction

Start by reading the actix_identity Identity and IdentityMiddleware APIs, focusing on the existing visit and login deadline settings. The issue proposes several competing designs, including Identity::login_with_deadline and per-identity deadline fields, but names no files or tests. Done would require an agreed design, implementation, and coverage for selecting or overriding deadlines per login.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.