{"action":"created","issue":{"url":"https://api.github.com/repos/yourlabs/django-session-security/issues/1","labels_url":"https://api.github.com/repos/yourlabs/django-session-security/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/yourlabs/django-session-security/issues/1/comments","events_url":"https://api.github.com/repos/yourlabs/django-session-security/issues/1/events","html_url":"https://github.com/yourlabs/django-session-security/issues/1","id":12417483,"number":1,"title":"Session incorrectly times out early if there is a long running request","user":{"login":"yscumc","id":3967697,"avatar_url":"https://avatars.githubusercontent.com/u/3967697?v=3","gravatar_id":"","url":"https://api.github.com/users/yscumc","html_url":"https://github.com/yscumc","followers_url":"https://api.github.com/users/yscumc/followers","following_url":"https://api.github.com/users/yscumc/following{/other_user}","gists_url":"https://api.github.com/users/yscumc/gists{/gist_id}","starred_url":"https://api.github.com/users/yscumc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yscumc/subscriptions","organizations_url":"https://api.github.com/users/yscumc/orgs","repos_url":"https://api.github.com/users/yscumc/repos","events_url":"https://api.github.com/users/yscumc/events{/privacy}","received_events_url":"https://api.github.com/users/yscumc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":28,"created_at":"2013-03-25T19:29:11Z","updated_at":"2015-02-12T02:33:15Z","closed_at":null,"body":"Using:\r\n====\r\nFirefox 19.0.2 with Firebug\r\nDjango (1.5)\r\ndjango-session-security (2.0.3)\r\n\r\nProblem:\r\n=======\r\nIf there's a long running request, the last activity stored in `request.session['_session_security']` is immediately set during the beginning of the request, but it is not returned to the client browser until the request is completed 45 seconds later. Since the session values are stored as cookies on the client side, all the ping requests during this 45 seconds which updated the last activity will be overwritten.\r\nWhen the long running request is finally completed, the last activity stored in `request.session['_session_security']` will be set to 45 seconds ago. If the next request is to the ping view, then all will be fine as the ping view updates the last activity. However, the the request request is another long running request, or something else which does NOT have the `idleFor` parameter (which means anything other than the ping request), then `delta.seconds` would be larger than `EXPIRE_AFTER` and `logout(request)` would be called. Any subsequent ping requests would return \"logout\" as a response, although the page the user is viewing would not immediately be logged out.\r\n\r\n\r\nTo reproduce:\r\n=========\r\n1. Use these settings:\r\n\r\n\\# Settings for session_security\r\nSESSION_SECURITY_WARN_AFTER = 10 # Default 540\r\nSESSION_SECURITY_EXPIRE_AFTER = 30 # Default 600 \r\nSESSION_EXPIRE_AT_BROWSER_CLOSE = True\r\n\r\n2. Open Firebug and enable Net to see the AJAX connections\r\n3. Create a page which requests something via AJAX that takes about 45 seconds for the request to complete, which upon completion would create another identical request.\r\n4. Log in and move the mouse when the warning comes on, then wait until the next warning comes on and move the mouse again.\r\n\r\n\r\nHere's an example of the requests to the ping view found from Firebug\r\n\r\nFirst Request\r\n```\r\nGET /session_security/ping/?csrfmiddlewaretoken=ZJgthGOkE5JTR1sS5uxYsc5fn9wd2vgG&idleFor=0&_=1364238435092 HTTP/1.1\r\nHost: localhost:8000\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:19.0) Gecko/20100101 Firefox/19.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nX-Requested-With: XMLHttpRequest\r\nReferer: http://localhost:8000/home/\r\nCookie: csrftoken=ZJgthGOkE5JTR1sS5uxYsc5fn9wd2vgG; sessionid=py3o4zs90uiojw3ylyb7hxo287n40om4\r\nConnection: keep-alive\r\n\r\nHTTP/1.0 200 OK\r\nDate: Mon, 25 Mar 2013 19:07:15 GMT\r\nServer: WSGIServer/0.1 Python/2.7.3\r\nVary: Cookie\r\nContent-Type: text/html; charset=utf-8\r\nSet-Cookie: sessionid=py3o4zs90uiojw3ylyb7hxo287n40om4; httponly; Path=/\r\n\r\n0\r\n```\r\n\r\nSecond Request, after long running request finished and started again\r\n```\r\nGET /session_security/ping/?csrfmiddlewaretoken=ZJgthGOkE5JTR1sS5uxYsc5fn9wd2vgG&idleFor=1&_=1364238445135 HTTP/1.1\r\nHost: localhost:8000\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:19.0) Gecko/20100101 Firefox/19.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nX-Requested-With: XMLHttpRequest\r\nReferer: http://localhost:8000/home/\r\nCookie: csrftoken=ZJgthGOkE5JTR1sS5uxYsc5fn9wd2vgG; sessionid=py3o4zs90uiojw3ylyb7hxo287n40om4\r\nConnection: keep-alive\r\n\r\nHTTP/1.0 200 OK\r\nDate: Mon, 25 Mar 2013 19:07:25 GMT\r\nServer: WSGIServer/0.1 Python/2.7.3\r\nVary: Cookie\r\nContent-Type: text/html; charset=utf-8\r\nSet-Cookie: sessionid=ipub9bxy50x3kleq5w2ekzbrxz0gdfa1; httponly; Path=/\r\n\r\nlogout\r\n```\r\n\r\nTwo things are wrong here:\r\n==================\r\n1. After receiving the **logout** response, the page is not immediately logged out. As long as I continue to move my mouse in the page when the warning comes up, I can stay on the page indefinitely, even though all the subsequent AJAX responses say **logout**. However, refreshing the page redirects me to the login screen, which means I was logged out.\r\n2. The **logout** response is incorrect since the \"idleFor\" is only 1 and it's been only 10 seconds since the last request. The **logout** really should not be triggered for another 29 seconds.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/yourlabs/django-session-security/issues/comments/74007364","html_url":"https://github.com/yourlabs/django-session-security/issues/1#issuecomment-74007364","issue_url":"https://api.github.com/repos/yourlabs/django-session-security/issues/1","id":74007364,"user":{"login":"jpic","id":94636,"avatar_url":"https://avatars.githubusercontent.com/u/94636?v=3","gravatar_id":"","url":"https://api.github.com/users/jpic","html_url":"https://github.com/jpic","followers_url":"https://api.github.com/users/jpic/followers","following_url":"https://api.github.com/users/jpic/following{/other_user}","gists_url":"https://api.github.com/users/jpic/gists{/gist_id}","starred_url":"https://api.github.com/users/jpic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jpic/subscriptions","organizations_url":"https://api.github.com/users/jpic/orgs","repos_url":"https://api.github.com/users/jpic/repos","events_url":"https://api.github.com/users/jpic/events{/privacy}","received_events_url":"https://api.github.com/users/jpic/received_events","type":"User","site_admin":false},"created_at":"2015-02-12T02:33:15Z","updated_at":"2015-02-12T02:33:15Z","body":"I was thinking:\n\n0) long polling to PASSIVE_URLS, to prevent any accuracy you have described\nand\n1) call sessionSecurity.activity() in JS meanwhile, to trigger update of\nlast session when necessary\n\nWould that work ?\n\nOn Wed, Feb 11, 2015 at 5:40 PM, yscumc <notifications@github.com> wrote:\n\n> I don't think this would work either, though I'm less certain this time.\n>\n> Django writes all the session data encoding in a single string as\n> session_data in the django_session table. Even if the session_security's\n> session data is not updated in the long running request, the rest of the\n> session data will be. That data won't include the latest session_security\n> data containing the user's activity and it will be re-encoded as a string\n> back into the django_session table. The next request will decode this\n> session_data and it won't include the latest session_security activity\n> either.\n>\n> However, this is all conjectures so maybe it'll behave differently?\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/yourlabs/django-session-security/issues/1#issuecomment-73926302>\n> .\n>\n\n\n\n-- \nhttp://yourlabs.org <http://blog.yourlabs.org>\nCustomer is king - Le client est roi - El cliente es rey.\n"}}