1019504 - Loop server should update session expires for anonymous clients

Status: VERIFIED FIXED

(Hello (Loop) :: Server, defect)

Description

[Mark Banner (:standard8)]

Currently the hawk session tokens for anonymous clients will expire 30 days (or the configured value) after the client first generates a push url, regardless of re-connections or new urls being generated.

As the ability to receive calls from urls is keyed to the token, this could cause the case where a user generates a url, but it only is valid for an hour, when it should be valid for 30 more days.

Really the session token should have its expiry refreshed at least every time a call url is generated, to ensure the token expiry is later than the call url expiry.

Comment 1

[Maire Reavy [:mreavy]]

Alexis -- Are you the dev working on this?

Comment 2

[Alexis Metaireau (:alexis)]

Attachment: link to github PR

Comment 3

[Alexis Metaireau (:alexis)]

This fixes one part of it. https://github.com/mozilla-services/loop-server/commit/c03efe509ffcbfe61079c7dbb713eea6eb4c139b

This touches the session each time you authenticate (not only on registration and call-url generation).

I also need to update the configuration so that the hawk session duration is longer than the max duration of a call url.

Rémy pointed out it also increases the load on the redis cluster, since it does one more call there each time we authenticate. I believe we'll see with load testing if that's a problem or not.

Comment 4

[Alexis Metaireau (:alexis)]

https://github.com/mozilla-services/loop-server/commit/eb8f913178c76312ea357102ce40999ebeda760b

Comment 5

[James Bonacci [:jbonacci]]

Verified in the code.