BitSquare/Codeman
2
0
Fork 0
mirror of https://github.com/Ark0N/Codeman.git synced 2026-10-05 23:19:43 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): re-issue session cookie on each request (sliding expiry)

Browse Source 
The codeman_session cookie was only set on the Basic Auth path with a fixed
lifetime from login and never refreshed, while the server-side session store
slides its TTL (refreshOnGet). So the browser cookie expired mid-use, the next
request arrived cookie-less and fell through to Basic Auth, popping the native
username/password dialog — perceived as a random logout while actively working.

Re-issue the cookie on every authenticated (valid-cookie) request so the browser
lifetime tracks the server-side sliding TTL.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dennis
2026-07-03 18:24:24 +00:00
co-authored by Claude Opus 4.8
parent 1fa88cd187
commit a842f2db4d
2 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/sliding-auth-cookie.md
+13
View File
@@ -0,0 +1,13 @@
---
"aicodeman": patch
---
fix(auth): slide the session cookie so active users aren't logged out
Re-issue the `codeman_session` cookie on every authenticated request so the
browser cookie lifetime tracks the server-side sliding TTL (the session store
already uses `refreshOnGet`). Previously the cookie was only set on the Basic
Auth path with a fixed 24h lifetime from login, so the browser dropped it
mid-use; the next request arrived cookie-less, fell through to Basic Auth and
popped the native username/password dialog — perceived as a random logout while
actively working.