Should session expiration time be reset upon each usage?
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 7.6k
- Forks
- 896
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 39
Description
I notice that in save_session we have:
value.set_times(ticketer::timebase(), recvd_ticket.new_ticket_lifetime, 0);
If I understand correctly, If the session was retrieved from the cached, this extends the lifetime of the ticket to the current time + its lifetime. However, I think if the session was retrieved from the cache then we should preserve its expiration time instead of extending it. Otherwise a session that is regularly resumed will never expire?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at save_session and inspect how cached sessions reach value.set_times(ticketer::timebase(), recvd_ticket.new_ticket_lifetime, 0). Trace whether a resumed session's existing expiration is available before this call. Done means confirming the intended expiration semantics and adding coverage for repeated session resumption without extending the original lifetime.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100