Skip to content

Expire session from init

What does this MR do and why?

This MR allows admins to configure Gitlab to compute session TTL based on date of session initialization rather than last activity or remember me status.

  • Adds setting to toggle "expire from creation" on sessions
  • If setting is enabled, prevents further activity or settings from extending the TTL of the session object in redis, instead sets TTL of new session key to be old TTL.

!395038 Other issues request similar support, this is just most in depth

How to set up and validate locally

  1. Navigate to the Admin Area > Settings > General > Account and Limit and enable "expire session from creation"
  2. Create a new user session
  3. Validate correct TTL for said session
  4. Perform an action as aforementioned user that would normally extend the session duration
  5. Validate the session TTL has not been reset and is from the time of original session creation.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by John Parent

Merge request reports