LPS-45084 - Autoextend session for guests, only show notification for logged in users

[JorgeFerrer]

We may want to run this through @shuyangzou just in case it may have an impact on performance when a guest users leaves a page open in a browser for a long period of time

[brianchandotcom]

@shuyangzhou Please see this pull. I think it should be fine.

[brianchandotcom]

Merged. Thank you.
View total diff: d290b07...10a4cb2

[shuyangzhou]

So that now a guest session never times out?

[JorgeFerrer]

@shuyangzhou yes, that's why I thought you should look into it.

[shuyangzhou]

This may actually cause a problem, but it is more like a security problem rather than a performance problem.
Basically it will make a DDoS attack easier. As it used to require all sessions to be active to hold them in memory. Now as long as they are guest session and not logout they will stay in memory, the attackers do not need to keep them active, it will allow the attacker to use few resources to organize a heavy attack.

I think we should run this through security team.

[NorbertKocsis]

Could you please confirm if this will be the final resolution or not? We would like to know if we can backport and deliver the fix for customers or we should wait.

Thanks in advance!