[Bug 521624] Accounts should maintain the state of the ECLIPSESESSION

Bugzilla Link	521624
Status	NEW
Importance	P3 normal
Reported	Aug 30, 2017 11:42 EDT
Modified	Sep 15, 2021 01:06 EDT

Description

When accounts.eclipse.org was deployed, one of the requirements was to create an ECLIPSESESSION after a user logs-in to support our current infrastructure.

For example, the Bugzilla manager for committers validate your access based off your ECLIPSESESSION.

Accounts.eclipse.org also creates a local Drupal session which can expire after the ECLIPSESESSION.

Accounts.eclipse.org should be able to detect that the ECLIPSESESSION has expired for a currently logged-in user and create a new session or update the expiry date of the previous session.

The main issue is that the ECLIPSESESSION is only created when the user successfully enter information on our login form. As long, as the drupal session is valid, it won't try to re-validate the ECLIPSESESSION.

assigned to @cguindon

assigned to @cguindon

moved from eclipsefdn/helpdesk#339 (moved)

added Bugzilla in Eclipse Foundation / Help Desk legacy in Eclipse Foundation / Help Desk + 1 deleted label

We should also consider forcing a logout on a user who's logged in on accounts.eclipse.org but his ECLIPSESESSION is expired.

This bug hasn't had any activity in quite some time. Maybe the problem got resolved, was a duplicate of something else, or became less pressing for some reason - or maybe it's still relevant but just hasn't been looked at yet.

If you have further information on the current state of the bug, please add it. The information can be, for example, that the problem still occurs, that you still want the feature, that more information is needed, or that the bug is (for whatever reason) no longer relevant.

--
The automated Eclipse Genie.

added Security label

added to epic &11 (closed)

added statetodo label

removed from epic &11 (closed)

added to epic &10 (closed)

This was already mostly implemented in Drupal 10. However, after a bit of testing, I did find a few issues that I am solving here: https://gitlab.eclipse.org/eclipsefdn/it/websites/drupal/eclipsefdn/-/merge_requests/528

1. The originally implementation was updating the ECLIPSESSIONS on every request. I am changing this to updating the sessions every 6 hours. This change was made to make the system more efficient.

2. Fix the cron job that is responsible for clearing session data every 8 days.

3. The server will only instruct the browser to clear the session cookie if a valid session is found and the user is not logged in to accounts.eclipse.org.

Note that users who don't accept our cookie consent banner won't have a persistent cookie. This means that their session cookie will disappear if they close their browser.

added webdev:php label

added team:webdev label

added statereview label and removed statetodo label