Ember-simple-auth: Session cookie expiration issues

[wiatrp]

Hi,

I have a problem with setting my cookie expiration. I'm attempting to set up a 'remember me' functionality and going from the documentation I implemented this:

const expirationTime = this.get('rememberMe') ? (14 * 24 * 60 * 60) : null;
this.set('session.store.cookieExpirationTime', expirationTime);

The problem is if I set 'remember me' with an expiration of 14 days later and log out/log in again without 'remember me', passing in null seems to leave the cookie at the original date of 14 days later instead of switching it to a session cookie. From reading through issue #395 it sounds like that is because the default when the window is reopened will be that original 14 days later.

I personally got passed this by just passing 'Session' into the expiration time (even though the documentation expresses that it expects an int or null) like so:

const expirationTime = this.get('rememberMe') ? (14 * 24 * 60 * 60) : 'Session';
this.set('session.store.cookieExpirationTime', expirationTime);

Whether this is intended or not, I don't know, but it is working perfectly so far. Is this a bug or is the documentation lacking? Or am I potentially doing something wrong?

[marcoow]

I guess this might actually be a bug. Actually the cookie would have to be rewritten when any of the relevant attributes of the store change. Would be cool if you could submit a PR that fixes that.

[stevenwu]

This is fixed in 1.20.

[sebastianhelbig]

I am still seeing the described issue of wiatrp on current master version.

this.set('session.store.cookieExpirationTime', 60 * 60 * 24 * 14);
…
this.set('session.store.cookieExpirationTime', null);

=> Cookies are expiring in 14d. (Cookies/Auth-State persist browser close)
=> Expected: Cookies should be rewritten as SessionCookie

[sebastianhelbig]

I do not want to hurry you, but are you already looking into the issue respectively do you have any timeframe?

[stevenwu]

@ktrhn We are looking into it and should have a fix soon. Work is in progress in #1257

[sebastianhelbig]

1257 didn't seem to fix this. At least it is not working yet in 1.2.1

(but workaround of wiatrp is working fine)

[marcoow]

@stevenwu: seems like this line would cause it to break for an expiration time of null? Do we need the check at all actually? I don't remember why it was added…

[marcoow]

There seems to be a problem in ember-cookies that returns undefined in places where we'd expect an empty string actually:

$E.write('test', null)
var a = $E.read('test')
a // undefined

That needs to be fixed. Then we can fix the line above and simply always update the expiration time property when the cookie exists, regardless of the value we get from the cookie.

[morgano86]

Any update on this? It causes some issues with Fastboot logging out on IOS which doesnt occur on desktop.

[marcoow]

I think what we should actually do is to check here whether the cookie exists at all and if so restore the value from it (if the value us null, restore that etc.).

[yaxinr]

my current solution:

const expirationTime = this.get('rememberMe') ? (14 * 24 * 60 * 60) : 90;
this.set('session.store.cookieExpirationTime', expirationTime);

[marcoow]

cleaning up old issues