[JIRA] (IDP-2124) Allow session cookie to be persistent

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on IDP-2124 ( https://shibboleth.atlassian.net/browse/IDP-2124?atlOrigin=eyJpIjoiMWY3M2ExNTRhNTZlNDcxYjg3Mzk5N2FiMzVlZGMxNmIiLCJwIjoiaiJ9 )

Re: Allow session cookie to be persistent ( https://shibboleth.atlassian.net/browse/IDP-2124?atlOrigin=eyJpIjoiMWY3M2ExNTRhNTZlNDcxYjg3Mzk5N2FiMzVlZGMxNmIiLCJwIjoiaiJ9 )

My intuition from an initial review is that this is really just a matter of pointing the session manager and the client storage service over to the “persistent” variants.

The persistent cookie manager gets used for things like warning cookies and uses a max-age defaulting to a year. The cookie lifetime has never had anything to do with session policy anyway so the cookie can last as long as it wants to, it’s not going to change how session policy works.

The storage service layer is trickier. The cookie there is strictly the fallback when local storage isn’t available, and the same logic applies. The cookie lifetime has nothing to do with the life of the records inside the serialized map that makes up the storage records, other than, obviously, if it disappears so do the records.

OTOH the local storage support API doesn’t really signal expiration anyway. There are APIs for session vs. cross-session storage, but that’s the same thing really, use the cross-session bucket exclusively and the data will stick around forever, and just get continually updated and cleaned up.

So there are a couple of options I guess, just get rid of the session variants altogether or conditionalize it all by property. I’m not sure it’s really worth bothering with the optionality, but OTOH, I hate to cater to this nonsense. Browser sessions should matter and if you want them to, they do. That’s important for shared machines so I think we probably should continue to allow for it.

( https://shibboleth.atlassian.net/browse/IDP-2124#add-comment?atlOrigin=eyJpIjoiMWY3M2ExNTRhNTZlNDcxYjg3Mzk5N2FiMzVlZGMxNmIiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-2124#add-comment?atlOrigin=eyJpIjoiMWY3M2ExNTRhNTZlNDcxYjg3Mzk5N2FiMzVlZGMxNmIiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:a994ca2 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230531/c90903a0/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-35610077-bd70-4bf0-b037-c964f13d0c96
Type: image/png
Size: 302 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230531/c90903a0/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-15708f4d-7de6-4784-8a3b-ff3cea9b5ce5
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230531/c90903a0/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-a4d8cef6-18bb-410e-ad1d-78fd57f768bb
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230531/c90903a0/attachment-0005.png>