feat(auth): add configurable MaxAge to auth cookies #9
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add MaxAge field to CookieSettings config to allow cookies to persist across browser sessions. Previously, cookies were created without MaxAge/Expires attributes, making them session cookies that browsers could clear at any time. This change: - Adds MaxAge field to CookieSettings struct (config.Duration type) - Updates CookieManager to store and use maxAge - Updates NewSecureCookie to accept maxAge parameter and set it on cookies - Updates all cookie creation calls to pass maxAge When maxAge is set (e.g., to match token lifespan like 168h), cookies will persist for that duration, reducing the frequency of re-authentication. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Tracking issue
Related to frequent re-authentication issues reported by users (flyte/grafana.heph sessions expiring quickly)
Why are the changes needed?
Users were experiencing frequent re-authentication prompts because auth cookies were created without
MaxAgeorExpiresattributes. This made them session cookies that browsers could clear at any time (e.g., when closing the browser, or based on browser-specific session management policies).By adding a configurable
MaxAgeto cookies, sessions can persist for a specified duration (e.g., matching the token lifespan of 168h), significantly reducing login frequency.What changes were proposed in this pull request?
MaxAgefield (typeconfig.Duration) toCookieSettingsstructmaxAgefield toCookieManagerstruct to store the configured valueNewSecureCookiefunction to accept amaxAge time.DurationparametermaxAge > 0, the cookie'sMaxAgeattribute is set accordinglyNewSecureCookiecall sites to pass the configuredmaxAge0for maxAge (backward compatible - session cookie behavior)Important for reviewers: This PR only adds the capability. To enable persistent cookies, the helm values need to be updated separately to set
cookieSettings.maxAge(e.g.,168hto match token lifespan).How was this patch tested?
TestSecureCookieLifecycle,TestGetHTTPRequestCookieToMetadataHandler)go test -v -run "TestSecureCookieLifecycle|TestGetHTTPRequestCookieToMetadataHandler" ./...inflyteadmin/authLabels
maxAgeconfiguration option for auth cookiesCheck all the applicable boxes
Human Review Checklist
config.Durationis the appropriate type forMaxAgefieldmaxAge > 0condition handles edge cases correctlyLink to Devin run: https://app.devin.ai/sessions/6bf80d9947cd470cba4919b461a7176f
Requested by: carlos