Page MenuHomePhabricator

Make partial sessions expire after 30 minutes, and do not extend them
ClosedPublic

Authored by epriestley on Dec 18 2018, 7:58 PM.
Tags
None
Referenced Files
F19503313: D19905.diff
Thu, Jan 8, 10:52 PM
F19304041: D19905.diff
Wed, Dec 24, 6:51 AM
F19138585: D19905.diff
Dec 10 2025, 11:07 AM
F19017147: D19905.id.diff
Nov 23 2025, 6:46 AM
F19010162: D19905.diff
Nov 22 2025, 2:36 AM
F18989205: D19905.diff
Nov 18 2025, 11:21 AM
F18918981: D19905.id47593.diff
Nov 9 2025, 11:26 AM
F18897990: D19905.id.diff
Nov 7 2025, 5:53 PM
Subscribers
None

Details

Summary

Depends on D19904. Ref T13226. Ref T13222. Currently, partial sessions (where you've provided a primary auth factor like a password, but not yet provided MFA) work like normal sessions: they're good for 30 days and extend indefinitely under regular use.

This behavior is convenient for full sessions, but normal users don't ever spend 30 minutes answering MFA, so there's no real reason to do it for partial sessions. If we add login alerts in the future, limiting partial sessions to a short lifetime will make them more useful, since an attacker can't get one partial session and keep extending it forever while waiting for an opportunity to get past your MFA.

Test Plan
  • Did a partial login (to the MFA prompt), checked database, saw a ~29 minute partial session.
  • Did a full login, saw session extend to ~30 days.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable