RPJosh
/
authelia
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
authelia/test/features/session-timeout.feature

24 lines
1.2 KiB
Gherkin
Raw Permalink Normal View History

Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
@needs-inactivity-config
Feature: Session is closed after a certain amount of time
@need-authenticated-user-john
Scenario: An authenticated user is disconnected after a certain inactivity period
Given I have access to:
| url |
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-02 20:34:07 +00:00
| https://public.example.com:8080/secret.html |
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
When I sleep for 6 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-02 20:34:07 +00:00
And I visit "https://public.example.com:8080/secret.html"
Then I'm redirected to "https://login.example.com:8080/?redirect=https%3A%2F%2Fpublic.example.com%3A8080%2Fsecret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
@need-authenticated-user-john
Scenario: An authenticated user is disconnected after session expiration period
Given I have access to:
| url |
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-02 20:34:07 +00:00
| https://public.example.com:8080/secret.html |
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
When I sleep for 4 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-02 20:34:07 +00:00
And I visit "https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
And I sleep for 4 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-02 20:34:07 +00:00
And I visit "https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-16 22:38:10 +00:00
And I sleep for 4 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-02 20:34:07 +00:00
And I visit "https://public.example.com:8080/secret.html"
Then I'm redirected to "https://login.example.com:8080/?redirect=https%3A%2F%2Fpublic.example.com%3A8080%2Fsecret.html"