Enhance Session Configuration Validation, Idle Timeout Enforcement, and Store Behavio #17
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Description:
The SCS session manager is initialized successfully and works with the current authentication flows. However, several pieces of functionality rely on conventions or defaults rather than explicit configuration, creating opportunities for subtle session-related issues in future development.
Improving session lifecycle handling, enforcing correct configuration values, and expanding the store options will further stabilize authentication behavior and security posture.
Current Behavior (observed in code):
Duration strings parsed without validation — silently fall back on defaults
Idle timeout settings depend on external middleware to refresh access
Cookie secure attributes tied solely to ProductionMode
In-memory session storage currently used by default (scs.New() store)
"Remember Me" logic partially implemented; rotation pending
Why this matters:
Ensures predictable security — particularly around idle timeouts and secure cookie policies
Enables future server scaling (remote store support)
Supports access control/security roadmap (admin flows, audit)
Prevents session abuse from misconfigurations
Scope of Work:
✅ Validate all duration settings at load time with clear errors
✅ Add logging/warnings when config values fallback to defaults
✅ Fully enforce idle timeout with tests validating middleware behavior
✅ Expand cookie policy options (e.g., Persistent, Strict SameSite optional)
✅ Allow secure session store configuration (file, DB, Redis)
✅ Complete and validate Remember-Me token rotation behavior
✅ Unit tests for session cookie flags + expiration behavior
Non-Goals:
No change to existing auth UX beyond stability/security fixes
No migration off SCS
Risks / Mitigations:
Low: Mainly configuration and validation behavior changes
✅ Mitigation: Deploy incrementally with logging before enforcing failures
Acceptance Criteria:
✅ Startup fails fast if duration fields invalid
✅ Idle timeouts verified via tests (automatic expiry)
✅ Session cookies respect secure settings based on environment
✅ Remote store option documented + bootstrap-ready
✅ Remember-Me rotation tested & replay-proof
Effort Estimate:
Medium (2–4 dev days)