lynndylanhurley / lynndylanhurley/devise_token_auth
Session times out in about 30 mins despite tweaking settings.
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 3.6k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
## Setup:
Using devise_token_auth v1.2.0 on an app with a Nuxt SPA talking to a Rails API backend.
## Problem:
The user's session times out after around 30 mins despite me tweaking a whole bunch of settings. Everything that I've tried so far:
1. `config.token_lifespan = 604800.seconds # 1 week` in `devise_token_auth.rb`
2. `config.change_headers_on_each_request = true` in `devise_token_auth.rb`
3. ` config.timeout_in = 5000000.minutes` in `devise.rb`
4. Remove `timeoutable` from the user.rb
## Observations
1. When the user gets logged out, the token still exists in the User table. Its still valid because the `expiry` field is still in the future.
2. When I log in again, it adds to the existing token, and doesnt delete the existing one. This confirms my suspicion that the existing token is still valid.
3. When I make a request in this logged out state with a valid token in the DB and I step through with a debugger, I see that it gets to at least [this point in the code](https://github.com/lynndylanhurley/devise_token_auth/blob/master/app/controllers/devise_token_auth/concerns/set_user_by_token.rb#L88)
What could I be doing wrong? I've checked the headers being passed back and they seem fine. Besides, why would the headers suddenly stop working around the half hour mark.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the timeout with the Nuxt SPA and Rails API, then start at app/controllers/devise_token_auth/concerns/set_user_by_token.rb around line 88. Review the reported settings in devise_token_auth.rb and devise.rb, along with user.rb, to trace why a token that remains valid in the database is rejected. Done means identifying the cause and verifying that valid sessions no longer expire unexpectedly around 30 minutes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nuxt, rails, ruby
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100