From cea9150fb7a4be74737138020dff1b523c9024cb Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Tue, 30 May 2023 10:59:42 +0000 Subject: [PATCH] [FIX] http: make session lifetime consistent and configurable Before 16.0 and https://github.com/odoo/odoo/pull/78857 the session cookie duration was set to 3 months, but the server-side garbage collection of inactive session was reaping them after 7 days of inactivity. The cookie lifetime was essentially superseded by the server-side GC. After https://github.com/odoo/odoo/pull/78857 these limits were made consistent with each other, but the lifetime value was kept at 3 months, which is a bit too long as a default. This commit changes the default SESSION_LIFETIME back to 7 days for both limits. In addition, since the server-side GC is now implemented by a database-specific cron job, this commit introduces an optional system parameter `sessions.max_inactivity_seconds` that can be set to override the default server-side GC threshold, to make it shorter. Note 1: the ICP does not modify the cookie lifetime which will remain set to the default 7 days. This means normal browser sessions won't stay alive for longer than 7 days of inactivity. So `sessions.max_inactivity_seconds` can't be effectively set to a longer expiration time. This seems like a reasonably safe default. Note 2: the session GC happens during the execution of the autovacuum cron job ("Base: Auto-vacuum internal data") which is scheduled once per day by default. When setting a small `sessions.max_inactivity_seconds` value, it may be necessary to increase the frequency of that cron job accordingly. closes odoo/odoo#122964 X-original-commit: 05ff9a2db32c2fb1afa107ac005423218f452290 Signed-off-by: Julien Castiaux (juc) --- odoo/addons/base/models/ir_http.py | 4 +++- odoo/http.py | 11 ++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/odoo/addons/base/models/ir_http.py b/odoo/addons/base/models/ir_http.py index 3eba7932a44..d5ab635a5f0 100644 --- a/odoo/addons/base/models/ir_http.py +++ b/odoo/addons/base/models/ir_http.py @@ -256,7 +256,9 @@ class IrHttp(models.AbstractModel): @api.autovacuum def _gc_sessions(self): - http.root.session_store.vacuum() + ICP = self.env["ir.config_parameter"] + max_lifetime = int(ICP.get_param('sessions.max_inactivity_seconds', http.SESSION_LIFETIME)) + http.root.session_store.vacuum(max_lifetime=max_lifetime) @api.model def get_translations_for_webclient(self, modules, lang): diff --git a/odoo/http.py b/odoo/http.py index 50ae1b9b64c..48cf1aa8763 100644 --- a/odoo/http.py +++ b/odoo/http.py @@ -280,9 +280,10 @@ if parse_version(werkzeug.__version__) >= parse_version('2.0.2'): # let's add the websocket key only when appropriate. ROUTING_KEYS.add('websocket') -# The duration of a user session before it is considered expired, -# three months. -SESSION_LIFETIME = 60 * 60 * 24 * 90 +# The default duration of a user session cookie. Inactive sessions are reaped +# server-side as well with a threshold that can be set via an optional +# config parameter `sessions.max_inactivity_seconds` (default: SESSION_LIFETIME) +SESSION_LIFETIME = 60 * 60 * 24 * 7 # The cache duration for static content from the filesystem, one week. STATIC_CACHE = 60 * 60 * 24 * 7 @@ -889,8 +890,8 @@ class FilesystemSessionStore(sessions.FilesystemSessionStore): session.should_rotate = False self.save(session) - def vacuum(self): - threshold = time.time() - SESSION_LIFETIME + def vacuum(self, max_lifetime=SESSION_LIFETIME): + threshold = time.time() - max_lifetime for fname in glob.iglob(os.path.join(root.session_store.path, '*', '*')): path = os.path.join(root.session_store.path, fname) with contextlib.suppress(OSError):