Exclude notification poll from sliding the idle session timeout#343
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
apodacaduron
left a comment
apodacaduron
left a comment
There was a problem hiding this comment.
Works as intended, notifications endpoint no longer refreshes session
2 participants
Problem
The session idle timeout (
PERMANENT_SESSION_LIFETIME) never fires. The notification poller hitsGET /admin/api/notificationsevery 60s, and with Flask-Session's defaultSESSION_REFRESH_EACH_REQUEST=Trueeach request rewrites the Redis session TTL back to full lifetime. A user who leaves a tab open is never logged out.Fix
Mark the automatic poll with an
X-Silent-Pollheader and overrideshould_set_storageso requests carrying it don't refresh the session expiry (unless they actually modified the session). All other requests, including user actions in the notification drawer, still slide the session.enferno/app.py— per-request opt-out inshould_set_storage.enferno/static/js/mixins/notification-mixin.js— only the interval-drivenrefetchNotificationssends the header; user-initiated loads do not.Tests
tests/test_session_poll_refresh.py: silent poll leaves the TTL untouched; a normal request still refreshes it.