Feature #16679
closed
Option to store token in session storage & idle timeout
Added by Peter Amstutz over 4 years ago.
Updated over 4 years ago.
Estimated time:
(Total: 0.00 h)
Release relationship:
Auto
Description
Option for Workbench 2 to store token in session storage instead of local storage, so that when the tab/browser is closed, the token is discarded.
"Open in new tab" operations should pass along the token (if possible) to avoid making the user log in again.
We should also add an idle timeout, it looks like we can do this via a react component:
https://blog.bitsrc.io/how-to-implement-idle-timeout-in-react-830d21c32942
Confirm (with tests) that Workbench 2 normal logout hits the API logout endpoint and expires the token.
- Description updated (diff)
- Target version set to 2020-09-09 Sprint
- Assigned To set to Lucas Di Pentima
From chat: We could publish the Login.TokenLifetime setting and use that to decide where to store the token.
- Subject changed from Option to store token in session storage to Option to store token in session storage & idle timeout
- Description updated (diff)
- Description updated (diff)
- Status changed from New to In Progress
Update at 0b38c1d85
- Exports
Login.TokenLifetime so that can be used by Workbench2 to store tokens on session storage.
Lucas Di Pentima wrote:
Update at 0b38c1d85
- Exports
Login.TokenLifetime so that can be used by Workbench2 to store tokens on session storage.
LGTM
Updates at arvados-workbench2|2a15974a - branch 16679-token-security-enhancements
Test run: developer-tests-workbench2: #88 
- Adds tests confirming that the logout endpoint is hit on logout.
- Adds auto logout component that gets used when
Workbench.IdleTimeout config is non-zero, with tests.
- Uses session storage on auth services when
Login.TokenLifetime config is non-zero.
- Removes
sessions list from storage on logout, as tokens are also saved there.
My only comment is that switching to session storage should probably be linked to enabling Workbench.IdleTimeout, not TokenLifetime. The rest LGTM.
- Status changed from In Progress to Resolved
- % Done changed from 50 to 100
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by Anonymous