dorfteich/docs/vs-nfd
Claude Fable 5 db4c5ce9ca
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 4m53s
CI / Build container images (pull_request) Successful in 3m55s
CI / Auth e2e pack (pull_request) Successful in 7m53s
CI / Import/export fidelity gate (pull_request) Successful in 55s
CD / Build and push images (push) Successful in 19s
CD / Deploy to Test (push) Successful in 12s
CD / Smoke tests against Test (push) Successful in 1m17s
CD / Promote to Int (push) Successful in 11s
CI / Lint, typecheck, test (push) Successful in 4m53s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 7m37s
CI / Import/export fidelity gate (push) Successful in 52s
#190: configurable session lifetime with a server-side idle timeout
SESSION_ABSOLUTE_HOURS (default 168 h) caps a session's total lifetime
from login: expiresAt is set once at creation and never extended — the
old sliding 30-day renewal is gone. SESSION_IDLE_HOURS (default 72 h)
ends sessions unused for that long, enforced server-side against
lastSeenAt with a write throttle scaled to the idle bound so short idle
windows still renew. Expired rows are removed on validation and the
session list applies both bounds, so idle-dead sessions never show as
active. The cookie maxAge follows the configured absolute bound.

Documented in .env.example (with the VS-NfD reference values for the
upcoming hardening guide #227), compose passes the variables through,
security.md and ADR 0007 record the amendment.

Refs #190

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ
2026-07-30 11:11:15 +02:00
..
00-analyse-auftrag.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
10-ist-aufnahme.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
20-massnahmenplan.md #190: configurable session lifetime with a server-side idle timeout 2026-07-30 11:11:15 +02:00
30-issue-adr-auftrag.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
31-issue-entwurf.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
40-abgrenzungserklaerung.md #226: add the §52 VSA delimitation statement 2026-07-30 06:29:05 +02:00