diff --git a/config/app.php b/config/app.php index 9d158e663..00c1b64a4 100644 --- a/config/app.php +++ b/config/app.php @@ -594,10 +594,17 @@ 'warning' => 'config.warning_logout', 'write_back' => true, ], + 'session.anonymous_lifetime' => [ + 'type' => 'number', + 'required' => true, + 'default' => 30 * 60, + 'env' => 'SESSION_ANONYMOUS_LIFETIME', + 'write_back' => true, + ], 'session.lifetime' => [ 'type' => 'number', 'required' => true, - 'default' => 30, + 'default' => 30 * 60 * 60 * 24, 'env' => 'SESSION_LIFETIME', 'write_back' => true, ], diff --git a/resources/lang/de_DE/additional.po b/resources/lang/de_DE/additional.po index 9fad5d55d..0497f3868 100644 --- a/resources/lang/de_DE/additional.po +++ b/resources/lang/de_DE/additional.po @@ -738,8 +738,11 @@ msgstr "PHP Session" msgid "config.session.name" msgstr "Session Cookie Name" +msgid "config.session.anonymous_lifetime" +msgstr "Anonymous Session Laufzeit in Sekunden" + msgid "config.session.lifetime" -msgstr "Session Laufzeit in Tagen" +msgstr "Session Laufzeit in Sekunden" msgid "config.jwt_expiration_time" msgstr "JWT Gültigkeit" diff --git a/resources/lang/en_US/additional.po b/resources/lang/en_US/additional.po index 9afe2193e..7cc4a96f5 100644 --- a/resources/lang/en_US/additional.po +++ b/resources/lang/en_US/additional.po @@ -731,8 +731,11 @@ msgstr "PHP session" msgid "config.session.name" msgstr "Session cookie name" +msgid "config.session.anonymous_lifetime" +msgstr "Anonymous session lifetime in seconds" + msgid "config.session.lifetime" -msgstr "Session lifetime in days" +msgstr "Session lifetime in seconds" msgid "config.jwt_expiration_time" msgstr "JWT expiration time in minutes" diff --git a/src/Controllers/AuthController.php b/src/Controllers/AuthController.php index 5c8fa4217..bd0a8f7eb 100644 --- a/src/Controllers/AuthController.php +++ b/src/Controllers/AuthController.php @@ -70,6 +70,7 @@ public function loginUser(User $user): Response $this->session->invalidate(); $this->session->set('user_id', $user->id); $this->session->set('locale', $user->settings->language); + $this->session->migrate(true, (int)($this->config->get('session')['lifetime'])); $user->last_login_at = new Carbon(); $user->save(['touch' => false]); diff --git a/src/Http/SessionHandlers/DatabaseHandler.php b/src/Http/SessionHandlers/DatabaseHandler.php index 666ca8324..4ef3322f0 100644 --- a/src/Http/SessionHandlers/DatabaseHandler.php +++ b/src/Http/SessionHandlers/DatabaseHandler.php @@ -60,10 +60,16 @@ public function destroy(string $id): bool */ public function gc(int $max_lifetime): int|false { - $sessionDays = config('session')['lifetime']; - $deleteBefore = Carbon::now()->subDays($sessionDays); + $deleteBefore = Carbon::now()->subSeconds(config('session')['lifetime']); + $deleteAnonymousBefore = Carbon::now()->subSeconds(config('session')['anonymous_lifetime']); - return Session::where('last_activity', '<', $deleteBefore) - ->delete(); + return + Session::where([ + ["user_id", "!=", "0"], + ["last_activity", "<", $deleteBefore] + ])->orWhere([ + ["user_id", "=", "0"], + ["last_activity", "<", $deleteAnonymousBefore] + ])->delete(); } } diff --git a/src/Http/SessionServiceProvider.php b/src/Http/SessionServiceProvider.php index d5ab93b5f..549a13d0e 100644 --- a/src/Http/SessionServiceProvider.php +++ b/src/Http/SessionServiceProvider.php @@ -62,7 +62,7 @@ protected function getSessionStorage(Request $request): SessionStorageInterface 'name' => $sessionConfig['name'], 'cookie_secure' => $request->isSecure(), 'cookie_httponly' => true, - 'cookie_lifetime' => (int) ($sessionConfig['lifetime'] * 24 * 60 * 60), + 'cookie_lifetime' => (int) ($sessionConfig['anonymous_lifetime']), ], 'handler' => $handler, ]); diff --git a/tests/Unit/Http/SessionHandlers/DatabaseHandlerTest.php b/tests/Unit/Http/SessionHandlers/DatabaseHandlerTest.php index 0f7ee5bb5..a345c1d82 100644 --- a/tests/Unit/Http/SessionHandlers/DatabaseHandlerTest.php +++ b/tests/Unit/Http/SessionHandlers/DatabaseHandlerTest.php @@ -125,7 +125,7 @@ public function testDestroy(): void */ public function testGc(): void { - $this->app->instance('config', new Config(['session' => ['lifetime' => 2]])); // 2 days + $this->app->instance('config', new Config(['session' => ['lifetime' => 2 * 24 * 60 * 60]])); // 2 days $table = $this->database->getConnection()->table('sessions'); $table