Skip to content

Backend to allow remember me to be disabled

Drew Blessing requested to merge dblessing_remember_me_application_setting_use_backend into master

What does this MR do and why?

Describe in detail what your merge request does and why.

Backend for https://gitlab.com/gitlab-org/gitlab/-/issues/369133. Frontend changes to hide the remember me checkbox as appropriate are covered in !119244 (merged).

UI to modify the application setting will be in a separate MR.

This MR also contains the feature specs to ensure session expiration and remember me work correctly together.

Behavior:

  • When remember me is disabled, no users a remembered on sign-in from that point forward.
  • Users who were already remembered are not automatically signed in on subsequent sign-ins.
  • remember_created_at value in the database remains populated until/unless User#forget_me! is called (which happens on sign out). But the above behavior ensures this value is inconsequential.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

  1. Select 'Remember me' and sign in.
  2. Close your browser and reopen.
  3. Visit GitLab and observe that you are signed in automatically.
  4. Disable remember me via Rails console. 
    settings = ApplicationSetting.last 
settings.remember_me_enabled = false
settings.save
  5. Close your browser and reopen.
  6. Visit GitLab and observe that you are signed out.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Drew Blessing

Merge request reports