Browse Source

Fix #4058 - Use a long-lived cookie to keep track of user-level sessions (#4091)

* Fix #4058 - Use a long-lived cookie to keep track of user-level sessions

* Fix tests, smooth migrate from previous session-based identifier
closed-social-v3
Eugen Rochko 7 years ago
committed by GitHub
parent
commit
00df69bc89
3 changed files with 25 additions and 8 deletions
  1. +1
    -1
      app/controllers/application_controller.rb
  2. +16
    -4
      config/initializers/devise.rb
  3. +8
    -3
      spec/rails_helper.rb

+ 1
- 1
app/controllers/application_controller.rb View File

@ -70,7 +70,7 @@ class ApplicationController < ActionController::Base
end
def current_session
@current_session ||= SessionActivation.find_by(session_id: session['auth_id'])
@current_session ||= SessionActivation.find_by(session_id: cookies.signed['_session_id'])
end
def cache_collection(raw, klass)

+ 16
- 4
config/initializers/devise.rb View File

@ -1,17 +1,29 @@
Warden::Manager.after_set_user except: :fetch do |user, warden|
SessionActivation.deactivate warden.raw_session['auth_id']
warden.raw_session['auth_id'] = user.activate_session(warden.request)
SessionActivation.deactivate warden.cookies.signed['_session_id']
warden.cookies.signed['_session_id'] = {
value: user.activate_session(warden.request),
expires: 1.year.from_now,
httponly: true,
}
end
Warden::Manager.after_fetch do |user, warden|
unless user.session_active?(warden.raw_session['auth_id'])
if user.session_active?(warden.cookies.signed['_session_id'] || warden.raw_session['auth_id'])
warden.cookies.signed['_session_id'] = {
value: warden.cookies.signed['_session_id'] || warden.raw_session['auth_id'],
expires: 1.year.from_now,
httponly: true,
}
else
warden.logout
throw :warden, message: :unauthenticated
end
end
Warden::Manager.before_logout do |_, warden|
SessionActivation.deactivate warden.raw_session['auth_id']
SessionActivation.deactivate warden.cookies.signed['_session_id']
warden.cookies.delete('_session_id')
end
Devise.setup do |config|

+ 8
- 3
spec/rails_helper.rb View File

@ -20,11 +20,16 @@ Sidekiq::Logging.logger = nil
Devise::Test::ControllerHelpers.module_eval do
alias_method :original_sign_in, :sign_in
def sign_in(resource, deprecated = nil, scope: nil)
def sign_in(resource, _deprecated = nil, scope: nil)
original_sign_in(resource, scope: scope)
SessionActivation.deactivate warden.raw_session["auth_id"]
warden.raw_session["auth_id"] = resource.activate_session(warden.request)
SessionActivation.deactivate warden.cookies.signed['_session_id']
warden.cookies.signed['_session_id'] = {
value: resource.activate_session(warden.request),
expires: 1.year.from_now,
httponly: true,
}
end
end

Loading…
Cancel
Save