Session expiry banner on the source index page

[kushaldas]

Description

From the release QA steps

Steps to Reproduce

• Log in to the application server and update the value of SESSION_EXPIRATION_MINUTES from 120 to 2 in /var/www/securedrop/config.py, then restart Apache with sudo systemctl restart apache2
• ❌ Visit the Source interface index page, and wait for slightly more than 2 minutes. Reload the index page, and verify that no session expiry error message is displayed. Failed, I can see session expiry message.

Expected Behavior

• no session banner should be shown

Actual Behavior

• can see a "session expired" banner

Comments

Suggestions to fix, any other relevant information.

[emkll]

@kushaldas I can also reproduce this issue. This appears to be an edge case where the show_expiration_message key set to true is not cleared from the session cookie after the user was logged out of a session due to inactivity at some point. Resetting creating a new Tor identity, or signing in and logging off as a user (without timeout) will clear that from the cookie.

Based on my local testing, this scenario only occurs where the user has already been logged out due to inactivity (and thus the value stored in the cookie).

Provided the analysis above is true, it might not be worth addressing here, given how unlikely this is to occur. What do you think? Is this consistent with your local testing? If you can reproduce in other cases, please check for presence of a set show_expiration_message key (the value of cookie ss is base64 encoded, you can decode locally to inspect the contents

[nabla-c0d3]

FYI I fixed this in the following PR, when I refactored the session expiration logic: https://github.com/freedomofpress/securedrop/pull/5694/files#diff-c2cc3d723ead9193ae70023970aee1a19eaec93bf2c0ffbf1a9a19d89dfb00feL124 .

[kushaldas]

Provided the analysis above is true, it might not be worth addressing here, given how unlikely this is to occur. What do you think? Is this consistent with your local testing?

Yes, I also prefer to have a fix later as this is a very rare case. I got the same behaviour as you documented here.

[sssoleileraaa]

Here are some related STRs: #5741. I'll keep them separate for now during QA but it probably makes sense to merge them into this Issue if we can't fix one or any of them during QA.

[nabla-c0d3]

This was fixed by #5694 and #5695.

[eloquence]

Thanks, closing accordingly, we'll test session management extensively during QA as well.