lynndylanhurley / lynndylanhurley/devise_token_auth
`config.cookie_attributes.expires` is problematic
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 3.6k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
Noticed while smoke testing a de-angularized, cookie-supporting version of ng-token-auth, when I was setting the expires config to a small value to test session expiration. Basically, the expires config gets set once when the server starts up, when really it should be calculated every time a new cookie token is made. I think we should just stop using expires and instead rely on the token_lifespan config via the build_auth_header method used in set_user_by_token. It'd be really easy to just pull that value from auth_header in set_cookie.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Trace config.cookie_attributes.expires and the build_auth_header, set_user_by_token, and set_cookie flow; start by locating those methods and checking how auth_header carries token_lifespan. Done means cookie expiry is calculated when each token is created rather than once at server startup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rails, ruby
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100