techies/authelia
1
0
Fork 0
mirror of https://github.com/0rangebananaspy/authelia.git synced 2024-09-14 22:47:21 +07:00
Code Issues Projects Releases Wiki Activity
5208c287be
authelia/test/features/session-timeout.feature

21 lines
1.0 KiB
Gherkin
Raw Normal View History

Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-17 05:38:10 +07:00
@needs-inactivity-config
Feature: Session is closed after a certain amount of time
@need-authenticated-user-john
Scenario: An authenticated user is disconnected after a certain inactivity period
Fix unit and integration tests
2018-03-29 05:04:59 +07:00
Given I have access to "https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-17 05:38:10 +07:00
When I sleep for 6 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-03 03:34:07 +07:00
And I visit "https://public.example.com:8080/secret.html"
Fix basic authentication and tests
2018-04-25 14:30:21 +07:00
Then I'm redirected to "https://login.example.com:8080/?rd=https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-17 05:38:10 +07:00
@need-authenticated-user-john
Scenario: An authenticated user is disconnected after session expiration period
Fix unit and integration tests
2018-03-29 05:04:59 +07:00
Given I have access to "https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-17 05:38:10 +07:00
When I sleep for 4 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-03 03:34:07 +07:00
And I visit "https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-17 05:38:10 +07:00
And I sleep for 4 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-03 03:34:07 +07:00
And I visit "https://public.example.com:8080/secret.html"
Implement session inactivity timeout This timeout will prevent an attacker from using a session that has been inactive for too long. This inactivity timeout combined with the timeout before expiration makes a good combination of security mechanisms to prevent session theft. If no activity timeout is provided, then the feature is disabled and only session expiration remains as a protection.
2017-10-17 05:38:10 +07:00
And I sleep for 4 seconds
Change domain from test.local to example.com Warning: you will need to update your /etc/hosts to take this change into account for the example environment to work.
2017-11-03 03:34:07 +07:00
And I visit "https://public.example.com:8080/secret.html"
Fix basic authentication and tests
2018-04-25 14:30:21 +07:00
Then I'm redirected to "https://login.example.com:8080/?rd=https://public.example.com:8080/secret.html"
Reference in New Issue Copy Permalink