session expiry message shows up when not logged in

[redshiftzero]

Description

This is a low-priority issue but filing for awareness: right now our session expiration applies to all routes on the application, including when users aren't logged in. Here is the relevant code.

Steps to Reproduce

1. Go to SecureDrop source interface homepage. Do not log in.
2. Wait for 120 minutes (this is SESSION_EXPIRATION_MINUTES).
3. Refresh the page.

Expected Behavior

Nothing happens, page reloads.

Actual Behavior

You'll get a flashed message indicating you have been logged out. This is odd for the user since they're not logged in.

Comments

A proposal is to only use the session expiration logic when logged_in is in the session object.

[sheonhan]

Hi @redshiftzero, I'd love to take this on as my first contribution to SecureDrop. I'll follow your proposal under the Comments heading as a guideline. Other than that, is there anything else I need to know before jumping in?

[kushaldas]

@sheonhan feel free to submit a PR (with tests), we can discuss if anything else is required at that. Thank you for showing interest.

[sheonhan]

@kushaldas I created a PR #5582 to fix this issue. Would appreciate any comments and suggestions!