diff options
| -rw-r--r-- | cmd/dashboard/main.go | 5 | ||||
| -rw-r--r-- | internal/config/constants.go | 5 |
2 files changed, 8 insertions, 2 deletions
diff --git a/cmd/dashboard/main.go b/cmd/dashboard/main.go index c9e1078..2c75313 100644 --- a/cmd/dashboard/main.go +++ b/cmd/dashboard/main.go @@ -61,7 +61,10 @@ func main() { sessionManager := scs.New() sessionManager.Store = sqlite3store.New(db.DB()) sessionManager.Lifetime = config.SessionLifetime - sessionManager.IdleTimeout = 24 * time.Hour // Extend session on activity + // Matches SessionLifetime rather than the previous 24h -- a day of not opening + // the dashboard (a normal gap, not "abandoned") was logging out a single user + // on their own device well before the 1-year Lifetime ever came into play. + sessionManager.IdleTimeout = config.SessionLifetime sessionManager.Cookie.Persist = true sessionManager.Cookie.Secure = !cfg.Debug sessionManager.Cookie.SameSite = http.SameSiteLaxMode diff --git a/internal/config/constants.go b/internal/config/constants.go index 1311302..98c7a60 100644 --- a/internal/config/constants.go +++ b/internal/config/constants.go @@ -45,7 +45,10 @@ const ( // Session settings const ( - SessionLifetime = 7 * 24 * time.Hour // 7 days for mobile convenience + // Single-user personal server -- there's no one else's session to protect by + // forcing frequent re-logins, so this is set for "don't make me log in again," + // not for a shared/multi-tenant threat model. + SessionLifetime = 365 * 24 * time.Hour ) // Rate limiting |