670024 - Change the login to SUMO to never expire

Status: VERIFIED FIXED

(support.mozilla.org :: Knowledge Base Software, task)

Description

[Crystal Beasley [:skinny, :crystal]]

Since we're not storing any credit card numbers, set the login to never expire.

Comment 1

[Erik Rose [:erik][:erikrose]]

Sounds great to me. Can anybody think of a reason not to?

Comment 2

[Kadir Topal [:atopal]]

Go for it!

Comment 3

[Kadir Topal [:atopal]]

My personal opinion of course.

Comment 4

[Ricky Rosario [:rrosario, :r1cky]]

It would be nice if access to the admin would require you to enter your password again, especially for superusers. It's the only part of the site where damage could be potentially done (getting access to pretty much the entire database + worse case of 24 hours of lost data). Although, hopefully all admins have their computers locked down.

Comment 5

[James Socol [:jsocol, :james]]

(In reply to comment #4)
> It would be nice if access to the admin would require you to enter your
> password again, especially for superusers. It's the only part of the site
> where damage could be potentially done (getting access to pretty much the
> entire database + worse case of 24 hours of lost data). Although, hopefully
> all admins have their computers locked down.

If you can find a way to do that, maybe as part of AdminPlus, I'd love to see it. I don't know of any way to enforce that in Django, or any concept of "re-authenticating" an authenticated session.

Comment 6

[Tanay Gavankar [:tgavankar]]

We could set the default session timeout to unlimited, and then perhaps write some kind of middleware that checks if the user's an admin, and if it is, use request.session.set_expiry() to update their session to have a shorter timeout? Hooray for Google searches.

I don't know how much overhead that may add though.

Comment 7

[James Socol [:jsocol, :james]]

Let's leave that for a follow up and just turn off SESSION_EXPIRE_AT_BROWSER_CLOSE and set SESSION_COOKIE_AGE to a month or so. (If we leave it too high, the database will fill up with abandoned sessions.)

Comment 8

[Erik Rose [:erik][:erikrose]]

Amen.

Comment 9

[Erik Rose [:erik][:erikrose]]

master: http://github.com/jsocol/kitsune/commit/6a9e46ce1c2f9328b45049210f56c5cc31b256f0

Comment 10

[Rebecca Billings [:rbillings]]

Verified login persists- nice change!