Log out and expire session for inactivity

jonnalley commented 1 year ago

User Story

As an OPS System Admin, I want to user sessions to expire after 30 minutes of inactivity so that the application can be compliant with requisite controls.

Acceptance Criteria

[x] Have a provision for session state to expire after the prescribed time (30 minutes)

Tasks

[x] Configure refresh tokens

Definition of Done Checklist

[ ] ~UI works as designed~
[x] OESA: Code refactored for clarity
[x] OESA: Dependency rules followed
[x] Automated unit tests updated and passed
[x] Automated integration tests updated and passed
[x] Automated quality tests updated and passed
[x] Automated load tests updated and passed
[x] Automated a11y tests updated and passed
[x] Automated security tests updated and passed
[x] 90%+ Code coverage achieved
[x] PR(s) have been merged to main
[x] Design/tech debt eliminated ~- [ ] Build process updated~ ~- [ ] Documentation updated or added~
[x] Feature flags/toggles created

Additional Context & Resources

jonnalley commented 1 year ago

The majority of this is already done in other stories/tasks (i.e. #447 ) but cleanup and refinement of the processes including any logging and auditing.

jonnalley commented 1 year ago

For a moderate-level system, we're only required to do 30 minutes. Not sure where 15 came in?

NIST 800-53 AC-12 and IA-11

xlorepdarkhelm commented 1 year ago

There is a note in the code, probably from Tim: FedRAMP AC-12 Control is 15 min

jonnalley commented 1 year ago

@xlorepdarkhelm yeah that's not accurate. AC-12 as selected and specified by HHS/ACF for FISMA moderate systems is 30 minutes.

jonnalley commented 1 year ago

@xlorepdarkhelm now that this is merged, will you please check off DoD ?

jonnalley commented 1 year ago

So I think this is technically working from my limited testing. However, I have a question, is it possible to actually redirect the user to /login when this inactivity time has been reached ?

Otherwise, the UX is not so great and they just get 400 errors on anything they click on and even the blue button in the upper-right implies they're still signed in.

xlorepdarkhelm commented 1 year ago

That is part of what Tim is working on.

jonnalley commented 1 year ago

9/11

HHS / OPRE-OPS