Update Expiration Date at every request

[fstephany]

Is there a way to update the expiration date (of both the cookie and the server-managed session) at every request? Something along the line what is described there: https://stackoverflow.com/questions/35106336/sessions-should-a-session-cookie-be-refreshed-for-each-request

I like "By sending it every time, the app ensures that the session expires two hours after their last page hit.". But is this even desirable security-wise?

[maxcountryman]

It's technically possible to do this manually with set_expiration_time. You could automate this with a custom extractor, for example and then use it as a middleware. That said, we could also support this more directly through additional configuration options. From a security perspective, it's dependent on your use case.

[0rzech]

You're right and, to be honest, modifying Expiry did feel off for me too. I have updated the code. The above link will show updated version.

Now there's the always_save field in SessionConfig with dedicated builder function, which makes unmodified sessions saved. This way the Expiry enum remains unchanged.

[maxcountryman]

That sounds like a more reasonable approach.

[0rzech]

And that's what you've actually suggested in the code. 😉 If you're fine with the current approach, I will proceed with tests and making a PR.

[maxcountryman]

Sounds good. Happy to review a PR.

[0rzech]

For anyone interested: related option has been released with version 0.13.0.