Logout on inactive

[jasalisbury]

Description of change
The idle modal shows after 25 minutes of inactivity. After 30 minutes of inactivity the user is logged out of the TTA smart hub. If the user becomes active while the modal is displayed it is hidden and the counters are reset.

Currently when the modal is shown the message says how long the user has until logout when the modal was first shown. I see two ways to improve the user experience:

1. We have a running countdown that updates until the user is logged out (e.g. T-minus 1 minute 2 seconds until logout)
2. We display the actual time at which the user is logged out (e.g. 10:55 am)

How to test

I've set sandbox to show the logout modal at 1 minute of inactivity and to logout users after an additional minute (2 minutes total). I'll need to remember to update the environment variables to 25 minutes (modal) and 30 minutes (logout) before merging.

1. Browse to sandbox https://tta-smarthub-sandbox.app.cloud.gov/
2. Login
3. Become inactive for a minute, note the modal
4. Wait an additional minute to get logged out

Notes

• We cannot set frontend environment variables per environment since they have to be set at build time. We will need to figure out how to do so soon. I can see us wanting to set feature flags for one environment but not another.
• I added a timeout to the session cookie sent from the server. The timeout is currently set at 30 minutes. This timeout is updated every time the user hits the server. There is a potential issue if a user is active on a page but not making API calls for 30 minutes. In that case the user's session will expire but they won't get explicitly logged out on the frontend. If this happens the next call to the API will give a 401, which we will need to handle. I gave some thought to having a 'heartbeat' API endpoint that gets hit periodically, but things get complicated when combined with the inactivity timeout. Let me know if you have any ideas!

Issue(s)

• As a user who has left my computer, I should be logged out after a period of inactivity, so my account remains secure (AC-2(5), AC-12) HHS/Head-Start-TTADP#79

Checklist

• Meets issue criteria
• Code tested
• Meets accessibility standards (WCAG 2.1 Levels A, AA)
• [n/a] Documentation updated
  • API methods
  • Boundary and Data Flow Diagrams
  • Architectural Decision Records written for major infrastructure decisions with the Nygard template
  • OSCAL templates completed when security controls are implemented or modified

[jasalisbury]

[kryswisnaskas]

Looks good! 👍

One comment on the text. Should "You will automatically be logged out..." be "You will be automatically logged out..." It sounds better, although I'll defer to @arickalewis1 on it.

There is a potential issue if a user is active on a page but not making API calls for 30 minutes. In that case the user's session will expire but they won't get explicitly logged out on the frontend. If this happens the next call to the API will give a 401, which we will need to handle. I gave some thought to having a 'heartbeat' API endpoint that gets hit periodically, but things get complicated when combined with the inactivity timeout. Let me know if you have any ideas!

This might be less of an issue with an autosave which will send changes to the database. I think if we redirect users to login on the backend when using various endpoints, we would eliminate the scenario when someone is active and just reading (not using the backend api) and then clicking to access the api.

[rahearn]

the scenario when someone is active and just reading

I do worry about this scenario, especially for the PS users, since they won't really be entering any data into the system for the MVP (though theoretically/hopefully they'll be hitting various GET endpoints as they navigate to different reports). What about the inactivity timeout was causing issues?

Potential idea: hit a heartbeat api every 15 minutes as long as the page is open in a browser tab. That will keep the backend session open while the user is potentially just reading, but allow the timeout to happen if the tab is closed. If the frontend timeout triggers because the tab is open but abandoned, then its proactive call to 'logout' will override the heartbeat keeping things alive.

[jasalisbury]

the scenario when someone is active and just reading

I do worry about this scenario, especially for the PS users, since they won't really be entering any data into the system for the MVP (though theoretically/hopefully they'll be hitting various GET endpoints as they navigate to different reports). What about the inactivity timeout was causing issues?

Potential idea: hit a heartbeat api every 15 minutes as long as the page is open in a browser tab. That will keep the backend session open while the user is potentially just reading, but allow the timeout to happen if the tab is closed. If the frontend timeout triggers because the tab is open but abandoned, then its proactive call to 'logout' will override the heartbeat keeping things alive.

HHS#132