Update Expiration Date at every request

[fstephany]

Is there a way to update the expiration date (of both the cookie and the server-managed session) at every request? Something along the line what is described there: https://stackoverflow.com/questions/35106336/sessions-should-a-session-cookie-be-refreshed-for-each-request

I like "By sending it every time, the app ensures that the session expires two hours after their last page hit.". But is this even desirable security-wise?

[maxcountryman]

It's technically possible to do this manually with set_expiration_time. You could automate this with a custom extractor, for example and then use it as a middleware. That said, we could also support this more directly through additional configuration options. From a security perspective, it's dependent on your use case.

[maxcountryman]

This crate is modeled fairly closely to Django's session contrib package, so it should behave similarly (if you find differently, please let me know).

[fstephany]

Ok! Thanks for the pointers 👍

[fstephany]

You are right, it seems that by default Django session does not resend the cookie with an updated expiration date. You must activate the feature manually by setting SESSION_SAVE_EVERY_REQUEST to get this behavior: https://docs.djangoproject.com/en/4.2/topics/http/sessions/#when-sessions-are-saved

[maxcountryman]

I'm open to adding this via a configuration option. So if someone would like to take a crack at that I'm happy to review a PR.

[fstephany]

I'm not familiar with tower/services/middleware/axum extractor. I'll give it a try as this looks like the perfect issue to get started.