Reduce lifetime of anonymous sessions

config/app.php

@@ -594,10 +594,17 @@
                     'warning' => 'config.warning_logout',
                     'write_back' => true,
                 ],
+                'session.anonymous_lifetime' => [
+                    'type' => 'number',
+                    'required' => true,
+                    'default' => 30 * 60,
+                    'env' => 'SESSION_ANONYMOUS_LIFETIME',
+                    'write_back' => true,
+                ],
                 'session.lifetime' => [
                     'type' => 'number',
                     'required' => true,
-                    'default' => 30,
+                    'default' => 30 * 60 * 60 * 24,
                     'env' => 'SESSION_LIFETIME',
                     'write_back' => true,
                 ],

resources/lang/de_DE/additional.po

@@ -738,8 +738,11 @@ msgstr "PHP Session"
 msgid "config.session.name"
 msgstr "Session Cookie Name"
 
+msgid "config.session.anonymous_lifetime"
+msgstr "Anonymous Session Laufzeit in Sekunden"
+
 msgid "config.session.lifetime"
-msgstr "Session Laufzeit in Tagen"
+msgstr "Session Laufzeit in Sekunden"
 
 msgid "config.jwt_expiration_time"
 msgstr "JWT Gültigkeit"

resources/lang/en_US/additional.po

@@ -731,8 +731,11 @@ msgstr "PHP session"
 msgid "config.session.name"
 msgstr "Session cookie name"
 
+msgid "config.session.anonymous_lifetime"
+msgstr "Anonymous session lifetime in seconds"
+
 msgid "config.session.lifetime"
-msgstr "Session lifetime in days"
+msgstr "Session lifetime in seconds"
 
 msgid "config.jwt_expiration_time"
 msgstr "JWT expiration time in minutes"

src/Controllers/AuthController.php

@@ -70,6 +70,7 @@ public function loginUser(User $user): Response
         $this->session->invalidate();
         $this->session->set('user_id', $user->id);
         $this->session->set('locale', $user->settings->language);
+        $this->session->migrate(true, (int)($this->config->get('session')['lifetime']));
 
         $user->last_login_at = new Carbon();
         $user->save(['touch' => false]);

src/Http/SessionHandlers/DatabaseHandler.php

@@ -60,10 +60,16 @@ public function destroy(string $id): bool
      */
     public function gc(int $max_lifetime): int|false
     {
-        $sessionDays = config('session')['lifetime'];
-        $deleteBefore = Carbon::now()->subDays($sessionDays);
+        $deleteBefore = Carbon::now()->subSeconds(config('session')['lifetime']);
+        $deleteAnonymousBefore = Carbon::now()->subSeconds(config('session')['anonymous_lifetime']);
 
-        return Session::where('last_activity', '<', $deleteBefore)
-            ->delete();
+        return
+            Session::where([
+                ["user_id", "!=", "0"],
+                ["last_activity", "<", $deleteBefore]
+            ])->orWhere([
+                ["user_id", "=", "0"],
+                ["last_activity", "<", $deleteAnonymousBefore]
+            ])->delete();
     }
 }

src/Http/SessionServiceProvider.php

@@ -62,7 +62,7 @@ protected function getSessionStorage(Request $request): SessionStorageInterface
                 'name'            => $sessionConfig['name'],
                 'cookie_secure'   => $request->isSecure(),
                 'cookie_httponly' => true,
-                'cookie_lifetime' => (int) ($sessionConfig['lifetime'] * 24 * 60 * 60),
+                'cookie_lifetime' => (int) ($sessionConfig['anonymous_lifetime']),
             ],
             'handler' => $handler,
         ]);

tests/Unit/Http/SessionHandlers/DatabaseHandlerTest.php

@@ -125,7 +125,7 @@ public function testDestroy(): void
      */
     public function testGc(): void
     {
-        $this->app->instance('config', new Config(['session' => ['lifetime' => 2]])); // 2 days
+        $this->app->instance('config', new Config(['session' => ['lifetime' => 2 * 24 * 60 * 60]])); // 2 days
 
         $table = $this->database->getConnection()->table('sessions');
         $table