3060 active user session #3182

raftmsohani · 2024-09-11T11:42:59Z

Summary of Changes

Pull request closes #3060 _

How to Test

List the steps to test the PR
These steps are generic, please adjust as necessary.

cd tdrs-frontend && docker-compose -f docker-compose.yml -f docker-compose.local.yml up -d
cd tdrs-backend && docker-compose -f docker-compose.yml -f docker-compose.local.yml up -d

Open http://localhost:3000/ and sign in.
The timeout is set 10 seconds, as long as you browse different pages, you will be considered active.

Deliverables

More details on how deliverables herein are assessed included here.

Deliverable 1: Accepted Features

Checklist of ACs:

A user session persists while the user is actively using the system
~~the session ends when the browser is closed~~
the session ends if the user is inactive for 15-30 minutes (see above)

lfrohlich and/or adpennington confirmed that ACs are met.

Deliverable 2: Tested Code

Are all areas of code introduced in this PR meaningfully tested?
- If this PR introduces backend code changes, are they meaningfully tested?
- If this PR introduces frontend code changes, are they meaningfully tested?
Are code coverage minimums met?
- Frontend coverage: [insert coverage %] (see CodeCov Report comment in PR)
- Backend coverage: [insert coverage %] (see CodeCov Report comment in PR)

Deliverable 3: Properly Styled Code

Are backend code style checks passing on CircleCI?
Are frontend code style checks passing on CircleCI?
Are code maintainability principles being followed?

Deliverable 4: Accessible

Does this PR complete the epic?
Are links included to any other gov-approved PRs associated with epic?
Does PR include documentation for Raft's a11y review?
Did automated and manual testing with iamjolly and ttran-hub using Accessibility Insights reveal any errors introduced in this PR?

Deliverable 5: Deployed

Was the code successfully deployed via automated CircleCI process to development on Cloud.gov?

Deliverable 6: Documented

Does this PR provide background for why coding decisions were made?
If this PR introduces backend code, is that code easy to understand and sufficiently documented, both inline and overall?
If this PR introduces frontend code, is that code easy to understand and sufficiently documented, both inline and overall?
If this PR introduces dependencies, are their licenses documented?
Can reviewer explain and take ownership of these elements presented in this code review?

Deliverable 7: Secure

Does the OWASP Scan pass on CircleCI?
Do manual code review and manual testing detect any new security issues?
If new issues detected, is investigation and/or remediation plan documented?

Deliverable 8: User Research

Research product(s) clearly articulate(s):

the purpose of the research
methods used to conduct the research
who participated in the research
what was tested and how
impact of research on TDP
(if applicable) final design mockups produced for TDP development

codecov · 2024-09-11T12:28:06Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.66%. Comparing base (3ed27eb) to head (1e01d38).
Report is 2 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #3182   +/-   ##
========================================
  Coverage    92.66%   92.66%           
========================================
  Files           47       47           
  Lines         1009     1009           
  Branches       169      169           
========================================
  Hits           935      935           
  Misses          42       42           
  Partials        32       32

Flag	Coverage Δ
dev-frontend	`92.66% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ccb07cc...1e01d38. Read the comment docs.

raftmsohani · 2024-09-20T17:27:38Z

backend is using django.contrib.session, which enables db backend session manager. However, we also enable cookie session enabled by SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies" which in turn happens to only respect default SESSION_COOKIE_AGE and not updated session timeout

raftmsohani · 2024-09-24T11:01:56Z

We are using signed-cookies to keep the session information, which is using SessionBase.
With every new request, the session timestamp is updated by signing a new session using signing package.

…app into 3060-active-user-session

tdrs-backend/tdpservice/core/custom_session_engine.py

raftmsohani · 2024-09-25T13:34:57Z

tdrs-backend/tdpservice/settings/common.py

-    SESSION_COOKIE_AGE = 15 * 60  # 15 minutes
+    #SESSION_EXPIRE_AT_BROWSER_CLOSE = True
+    SESSION_SAVE_EVERY_REQUEST = True
+    SESSION_COOKIE_AGE = 10  # 15 minutes


For testing only: revert back to previous setting

…app into 3060-active-user-session

raftmsohani · 2024-09-26T13:21:32Z

tdrs-backend/tdpservice/data_files/admin/admin.py

@@ -1,7 +1,6 @@
 """Admin class for DataFile objects."""
 from django.contrib import admin
 from tdpservice.core.utils import ReadOnlyAdminMixin
-# from tdpservice.core.filters import custom_filter_title


Unrelated to this PR but I saw this is commented and not deleted

…app into 3060-active-user-session

ADPennington · 2024-10-10T21:13:28Z

tdrs-backend/tdpservice/settings/common.py

@@ -281,10 +281,12 @@ class Common(Configuration):
    )

    # Sessions
-    SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies"
+    SESSION_ENGINE = "tdpservice.core.custom_session_engine"
+    SIGNED_COOKIE_EXPIRES = 60 * 60 * 24  # 24 hours


@raftmsohani is this set to expire 24 hours from the initial session? if so, i wonder if it would be better to shorten this to 12 hours, which is on the very high end of an average work day. i'm also reaching out to our security officer about this.

evidence below suggests expiry 24 hours into future. left side is staging (current state) and right side is qasp (this branch)

@raftmsohani TDP's ISSO's feedback:

this change is related to AC-2-5. We'll need to update this documentation as part of this work to capture how the session refresh/expiration works for ACF users.

let's also reduce the expiration to 12 hours

we'll likely need to also complete risk-based decision documentation when the security team provides it.

@ADPennington we shouldn't need to update the AC-2-5, since we are still following same time out concept. In fact, this PR makes sure we are exactly following this time out setting.
The only difference is: with new changes, even if the user is active, system will log the user out after 12hrs

confirming that the AC-2-5 seems aligned with the behavior in this PR, particularly this part: If the user chooses to extend the session, TDP will refresh the session.

ADPennington

feedback included in comments.

ADPennington · 2024-10-16T16:02:49Z

tdrs-backend/tdpservice/settings/common.py

    SESSION_COOKIE_HTTPONLY = True
    SESSION_SAVE_EVERY_REQUEST = True
-    #SESSION_EXPIRE_AT_BROWSER_CLOSE = True
-    SESSION_COOKIE_AGE = 10  # 15 minutes
+    SESSION_COOKIE_AGE = 60 * 30  # 30 minutes


@raftmsohani can confirm that I received the warning for inactivity while logged in via AMS. im gonna wait another 30 minutes, because Im trying to understand the relationship between cookie_age and cookie_expires. max age set to 30 minutes when looking at devtools.

ADPennington

🚀 thanks @raftmsohani

no change

c0ec6fb

raftmsohani self-assigned this Sep 11, 2024

raftmsohani added the Deploy with CircleCI-raft Deploy to https://tdp-frontend-raft.app.cloud.gov through CircleCI label Sep 11, 2024

lok into token

be56f66

raftmsohani removed the Deploy with CircleCI-raft Deploy to https://tdp-frontend-raft.app.cloud.gov through CircleCI label Sep 11, 2024

raftmsohani added the Deploy with CircleCI-raft Deploy to https://tdp-frontend-raft.app.cloud.gov through CircleCI label Sep 11, 2024

raftmsohani added 2 commits September 13, 2024 11:48

Merge branch 'develop' into 3060-active-user-session

269243d

Merge branch 'develop' into 3060-active-user-session

5c4a602

Merge branch 'develop' into 3060-active-user-session

998c60a

raftmsohani and others added 4 commits September 24, 2024 07:31

Merge branch 'develop' into 3060-active-user-session

b7109e1

Added a custom session handler instead of signed_sessions

3de4cad

Merge branch '3060-active-user-session' of github.com:raft-tech/TANF-…

dc48d36

…app into 3060-active-user-session

Update common.py

0658bea

raftmsohani commented Sep 25, 2024

View reviewed changes

tdrs-backend/tdpservice/core/custom_session_engine.py Outdated Show resolved Hide resolved

Update README.md

5809393

raftmsohani commented Sep 25, 2024

View reviewed changes

raftmsohani added 5 commits September 25, 2024 09:37

added a new settings

5390920

Merge branch '3060-active-user-session' of github.com:raft-tech/TANF-…

338aea0

…app into 3060-active-user-session

Merge branch 'develop' into 3060-active-user-session

406e52e

3060 linting

021bf69

3060 linting

66ee523

raftmsohani commented Sep 26, 2024

View reviewed changes

3060 remove unused params

cec22a4

raftmsohani requested review from andrew-jameson, jtimpe and elipe17 September 26, 2024 13:43

raftmsohani added the raft review This issue is ready for raft review label Sep 26, 2024

Merge branch 'develop' into 3060-active-user-session

ee5052f

jtimpe approved these changes Oct 9, 2024

View reviewed changes

raftmsohani added 2 commits October 10, 2024 11:49

remove unused overrides

6abb325

Merge branch '3060-active-user-session' of github.com:raft-tech/TANF-…

5f9b420

…app into 3060-active-user-session

raftmsohani added QASP Review and removed raft review This issue is ready for raft review labels Oct 10, 2024

raftmsohani requested a review from ADPennington October 10, 2024 15:50

ADPennington removed the Deploy with CircleCI-raft Deploy to https://tdp-frontend-raft.app.cloud.gov through CircleCI label Oct 10, 2024

Merge branch 'develop' into 3060-active-user-session

ae787a3

ADPennington added the Deploy with CircleCI-qasp Deploy to https://tdp-frontend-qasp.app.cloud.gov through CircleCI label Oct 10, 2024

ADPennington reviewed Oct 10, 2024

View reviewed changes

ADPennington added OCIO Review and removed Deploy with CircleCI-qasp Deploy to https://tdp-frontend-qasp.app.cloud.gov through CircleCI labels Oct 10, 2024

ADPennington requested changes Oct 11, 2024

View reviewed changes

ADPennington added raft review This issue is ready for raft review and removed QASP Review OCIO Review labels Oct 11, 2024

raftmsohani and others added 3 commits October 15, 2024 09:14

Merge branch 'develop' into 3060-active-user-session

6d28693

corrected the timeouts

1b3984d

Merge branch 'develop' into 3060-active-user-session

1e01d38

ADPennington added the Deploy with CircleCI-qasp Deploy to https://tdp-frontend-qasp.app.cloud.gov through CircleCI label Oct 16, 2024

andrew-jameson added QASP Review and removed raft review This issue is ready for raft review labels Oct 16, 2024

ADPennington reviewed Oct 16, 2024

View reviewed changes

ADPennington removed the Deploy with CircleCI-qasp Deploy to https://tdp-frontend-qasp.app.cloud.gov through CircleCI label Oct 16, 2024

ADPennington approved these changes Oct 16, 2024

View reviewed changes

ADPennington added Ready to Merge and removed QASP Review labels Oct 16, 2024

raftmsohani merged commit 34fb345 into develop Oct 16, 2024
27 checks passed

raftmsohani deleted the 3060-active-user-session branch October 16, 2024 19:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

3060 active user session #3182

3060 active user session #3182

raftmsohani commented Sep 11, 2024 •

edited by ADPennington

Loading

codecov bot commented Sep 11, 2024 •

edited

Loading

raftmsohani commented Sep 20, 2024

raftmsohani commented Sep 24, 2024 •

edited

Loading

raftmsohani Sep 25, 2024

raftmsohani Sep 26, 2024

ADPennington Oct 10, 2024

ADPennington Oct 10, 2024 •

edited

Loading

ADPennington Oct 11, 2024

raftmsohani Oct 15, 2024

ADPennington Oct 16, 2024

ADPennington left a comment

ADPennington Oct 16, 2024

ADPennington left a comment

3060 active user session #3182

3060 active user session #3182

Conversation

raftmsohani commented Sep 11, 2024 • edited by ADPennington Loading

Summary of Changes

How to Test

Deliverables

codecov bot commented Sep 11, 2024 • edited Loading

Codecov Report

raftmsohani commented Sep 20, 2024

raftmsohani commented Sep 24, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ADPennington Oct 10, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ADPennington left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ADPennington left a comment

Choose a reason for hiding this comment

raftmsohani commented Sep 11, 2024 •

edited by ADPennington

Loading

codecov bot commented Sep 11, 2024 •

edited

Loading

raftmsohani commented Sep 24, 2024 •

edited

Loading

ADPennington Oct 10, 2024 •

edited

Loading