[VS-NfD] Make the session lifetime configurable and add an idle timeout #190

New Issue

fable-5 · 2026-07-30T01:43:28+02:00

fable-5 commented

2026-07-30 01:43:28 +02:00

Plan reference: 20-massnahmenplan.md -> Phase 2
ADR: n/a
Effort: M (1–2 AT)
Depends on: —

Context

A sliding 30-day session is far outside what a VS-NfD operating concept
accepts, and it is a compile-time constant today. The operator must be able
to set both an absolute and an idle bound.

Current state

apps/api/src/auth/sessions.service.ts:8:
const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // sliding 30 days,
applied at creation (:31) and renewed on every touch (:50).
apps/api/src/auth/auth.guard.ts:58 sets the cookie maxAge to the same
30 days.
No idle timeout exists; lastSeenAt is written but never used as a bound.

Acceptance criteria

Absolute lifetime and idle timeout are separately configurable, with
defaults well below 30 days; the cookie maxAge follows the
configured value.
Idle expiry is enforced server-side against lastSeenAt, not only by
cookie expiry.
Tests: session past its absolute bound is rejected; session idle past
the idle bound is rejected; active use renews idle but never exceeds
the absolute bound.
Hardening guide (#227) names the recommended VS-NfD values;
.env.example documents the settings.

Out of scope

Forced re-authentication for individual actions, and concurrent-session
limits.

**Plan reference:** `20-massnahmenplan.md` -> Phase 2 **ADR:** n/a **Effort:** M (1–2 AT) **Depends on:** — ## Context A sliding 30-day session is far outside what a VS-NfD operating concept accepts, and it is a compile-time constant today. The operator must be able to set both an absolute and an idle bound. ## Current state - `apps/api/src/auth/sessions.service.ts:8`: `const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // sliding 30 days`, applied at creation (`:31`) and renewed on every touch (`:50`). - `apps/api/src/auth/auth.guard.ts:58` sets the cookie `maxAge` to the same 30 days. - No idle timeout exists; `lastSeenAt` is written but never used as a bound. ## Acceptance criteria - [ ] Absolute lifetime and idle timeout are separately configurable, with defaults well below 30 days; the cookie `maxAge` follows the configured value. - [ ] Idle expiry is enforced server-side against `lastSeenAt`, not only by cookie expiry. - [ ] Tests: session past its absolute bound is rejected; session idle past the idle bound is rejected; active use renews idle but never exceeds the absolute bound. - [ ] Hardening guide (#227) names the recommended VS-NfD values; `.env.example` documents the settings. ## Out of scope Forced re-authentication for individual actions, and concurrent-session limits.

fable-5 added this to the M24 — VS-NfD: security quick wins milestone 2026-07-30 01:43:28 +02:00

fable-5 added the

effort:M

vs-nfd

area:auth

labels 2026-07-30 01:43:29 +02:00

fable-5 referenced this issue

2026-07-30 01:43:34 +02:00

[VS-NfD] Verify that no real `.env` is shipped and document the example as authoritative #198

fable-5 referenced this issue from a commit

2026-07-30 11:11:17 +02:00

#190: configurable session lifetime with a server-side idle timeout