RPJosh
/
authelia
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
authelia/test/features/session-timeout.feature

21 lines
1.0 KiB
Gherkin
Raw Permalink Normal View History

Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
@needs-inactivity-config
Feature: Session is closed after a certain amount of time
@need-authenticated-user-john
Scenario: An authenticated user is disconnected after a certain inactivity period
Fix unit and integration tests
2018-03-28 22:04:59 +00:00
Given I have access to "https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
When I sleep for 6 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-02 20:34:07 +00:00
And I visit "https://public.example.com:8080/secret.html"
Fix basic authentication and tests
2018-04-25 07:30:21 +00:00
Then I'm redirected to "https://login.example.com:8080/?rd=https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
@need-authenticated-user-john
Scenario: An authenticated user is disconnected after session expiration period
Fix unit and integration tests
2018-03-28 22:04:59 +00:00
Given I have access to "https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
When I sleep for 4 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-02 20:34:07 +00:00
And I visit "https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
And I sleep for 4 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-02 20:34:07 +00:00
And I visit "https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
And I sleep for 4 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-02 20:34:07 +00:00
And I visit "https://public.example.com:8080/secret.html"
Fix basic authentication and tests
2018-04-25 07:30:21 +00:00
Then I'm redirected to "https://login.example.com:8080/?rd=https://public.example.com:8080/secret.html"