Logout when inactive

[jasalisbury]

Description of change
The idle modal shows after 25 minutes of inactivity. After 30 minutes of inactivity the user is logged out of the TTA smart hub. If the user becomes active while the modal is displayed it is hidden and the counters are reset.

Currently when the modal is shown the message says how long the user has until logout when the modal was first shown. I see two ways to improve the user experience:

1. We have a running countdown that updates until the user is logged out (e.g. T-minus 1 minute 2 seconds until logout)
2. We display the actual time at which the user is logged out (e.g. 10:55 am)

How to test

I've set sandbox to show the logout modal at 1 minute of inactivity and to logout users after an additional minute (2 minutes total). I'll need to remember to update the environment variables to 25 minutes (modal) and 30 minutes (logout) before merging.

1. Browse to sandbox https://tta-smarthub-sandbox.app.cloud.gov/
2. Login
3. Become inactive for a minute, note the modal
4. Wait an additional minute to get logged out

Notes

• We cannot set frontend environment variables per environment since they have to be set at build time. We will need to figure out how to do so soon. I can see us wanting to set feature flags for one environment but not another.
• I added a timeout to the session cookie sent from the server. The timeout is currently set at 30 minutes. This timeout is updated every time the user hits the server. There is a potential issue if a user is active on a page but not making API calls for 30 minutes. In that case the user's session will expire but they won't get explicitly logged out on the frontend. If this happens the next call to the API will give a 401, which we will need to handle. I gave some thought to having a 'heartbeat' API endpoint that gets hit periodically, but things get complicated when combined with the inactivity timeout. Let me know if you have any ideas!

Issue(s)

• closes As a user who has left my computer, I should be logged out after a period of inactivity, so my account remains secure (AC-2(5), AC-12) #79

Checklist

• Meets issue criteria
• Code tested
• Meets accessibility standards (WCAG 2.1 Levels A, AA)
• [n/a] Documentation updated
  • API methods
  • Boundary and Data Flow Diagrams
  • Architectural Decision Records written for major infrastructure decisions with the Nygard template
  • OSCAL templates completed when security controls are implemented or modified

[rahearn]

Great work! I'd like to see the accessibility change before merging this in.

Also, can we set the timeout via a CircleCI variable? I don't want a 2 minute timeout in staging/prod, but maybe it's a decent workaround to have one set of flags for staging/production and one for dev/sandbox, at least until something more involved is needed and can be developed.