nngo/GOV_QR_Codes_Management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed remember login function

Browse Source
This commit is contained in:
nngo
2025-11-09 12:46:57 -05:00
parent 5c77376272
commit d61cd12c50
2 changed files with 22 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advanced_security_middleware.py
+16 -14
View File
@@ -176,10 +176,11 @@ class SecurityManager:
if not stored_token or not hmac.compare_digest(session_token, stored_token['token']): if not stored_token or not hmac.compare_digest(session_token, stored_token['token']):
return False return False
# Check session timeout # Check session timeout - skip if "Remember Me" is enabled
if time.time() - stored_token['created'] > self.session_timeout: if not session.get('remember_me', False):
del self.session_tokens[user_id] if time.time() - stored_token['created'] > self.session_timeout:
return False del self.session_tokens[user_id]
return False
# Check if session IP matches (optional security measure) # Check if session IP matches (optional security measure)
if self.app.config.get('STRICT_SESSION_IP', False): if self.app.config.get('STRICT_SESSION_IP', False):
@@ -425,17 +426,18 @@ def enhanced_login_required(f):
session.clear() session.clear()
return jsonify({'error': 'Session security validation failed'}), 401 return jsonify({'error': 'Session security validation failed'}), 401
# Check session timeout # Check session timeout - skip if "Remember Me" is enabled
login_time_str = session.get('login_time') if not session.get('remember_me', False):
if login_time_str: login_time_str = session.get('login_time')
try: if login_time_str:
login_time = datetime.fromisoformat(login_time_str) try:
if datetime.utcnow() - login_time > timedelta(hours=8): login_time = datetime.fromisoformat(login_time_str)
if datetime.utcnow() - login_time > timedelta(hours=8):
session.clear()
return jsonify({'error': 'Session expired'}), 401
except ValueError:
session.clear() session.clear()
return jsonify({'error': 'Session expired'}), 401 return jsonify({'error': 'Invalid session data'}), 401
except ValueError:
session.clear()
return jsonify({'error': 'Invalid session data'}), 401
return f(*args, **kwargs) return f(*args, **kwargs)
return decorated_function return decorated_function
app.py
+6
View File
@@ -32,8 +32,12 @@ app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY')
app.config['SQLALCHEMY_DATABASE_URI'] = os.environ.get('DATABASE_URL') app.config['SQLALCHEMY_DATABASE_URI'] = os.environ.get('DATABASE_URL')
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = os.environ.get('SQLALCHEMY_TRACK_MODIFICATIONS') app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = os.environ.get('SQLALCHEMY_TRACK_MODIFICATIONS')
app.config['TEMPLATES_AUTO_RELOAD'] = os.environ.get('TEMPLATES_AUTO_RELOAD') app.config['TEMPLATES_AUTO_RELOAD'] = os.environ.get('TEMPLATES_AUTO_RELOAD')
# Session configuration for "Remember Me" functionality # Session configuration for "Remember Me" functionality
app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=30) app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=30)
app.config['SESSION_COOKIE_SECURE'] = False # Set to True if using HTTPS
app.config['SESSION_COOKIE_HTTPONLY'] = True
app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
# Initialize database # Initialize database
db = SQLAlchemy(app) db = SQLAlchemy(app)
@@ -1537,8 +1541,10 @@ def login():
# Set session as permanent if "Remember Me" is checked # Set session as permanent if "Remember Me" is checked
if remember_me: if remember_me:
session.permanent = True session.permanent = True
session['remember_me'] = True
else: else:
session.permanent = False session.permanent = False
session['remember_me'] = False
# Successful login # Successful login
session['user_id'] = user.id session['user_id'] = user.id