UI authentication session is not expiring

[Vladimir Grevtsev]

One of our customers made a pentesting assessment and the following recommendations were issued:

- Set session timeout to the minimal value possible depending on the context of the application.
- Avoid "infinite" session timeout.

Currently, authenticated sessions are remaining active indefinitely after their last use. If an authenticated user were to leave a browser window open without explicitly logging out of the application, another person may be able to resume that user's session several hours later simply by browsing to the MAAS UI on the same computer.

[Huw Wilkins (huwshimi)]

The session cookie is created by Django which also dictates the cookie expiry (in fact the cookie has HttpOnly so can't be accessed by JavaScript).

I think the expiry can be controlled by SESSION_COOKIE_AGE:

https://docs.djangoproject.com/en/3.0/ref/settings/#session-cookie-age

[Jerzy Husakowski (jhusakowski)]

An upcoming release of MAAS will allow users to specify session timeout. Let's re-test this issue on that release.

[Anton Troyanov (troyanov)]

https://code.launchpad.net/~ack/maas/+git/maas/+merge/438669

commit a69b8a3f58d65aba92d788c8e89aaf38e1258a93
Author: Alberto Donato <email address hidden>
Date: Fri Mar 10 15:01:42 2023 +0000

    periodically check and disconnect expired websocket sessions

❯ git tag --contains a69b8a3f58d65aba92d788c8e89aaf38e1258a93
3.4.0
3.4.0-beta1
3.4.0-beta2
3.4.0-beta3
3.4.0-rc1
3.4.0-rc2
3.5.0-beta1