Session improvements - Githubissues

ngoduykhanh / wireguard-ui

Wireguard web interface

MIT License

3.78k stars 464 forks source link

Session improvements #510

Closed 0xCA closed 5 months ago

0xCA commented 6 months ago

Session improvements

Fixed and improved

Fixed session duration
Use MaxAge instead of Expires
Added cookie refresh on all pages (API calls are ignored)
Refresh not sooner than 24h
Do not refresh temporary sessions
Delete cookies on logout
Enhanced security
Use HttpOnly and SameSite
Auth + Encryption for cookies, based on SessionSecret, via SHA512
Verify if the cookie is not too old and not from the future
Verify if the user exists and unchanged
Any change to the user logs out all other sessions as a result
Params

Variable Description Default

SESSION_MAX_DURATION Max time in days a remembered session is refreshed and valid. Non-refreshed session is valid for 7 days max, regardless of this setting. 90

Discussion

Open for discussion, please check for errors

0xCA commented 5 months ago

After all, I decided to panic on gob-incompatible model.User Should be ready for merge after testing and review