timescale.info
Sign inSign up

How OpenChronology was built

Every merged pull request of openchronology/timeline-app, its first week of commits and its releases; and before them the 2020 PureScript editor, from snapshots of its deleted repositories in the Wayback Machine. Written to this server through the HTTP API.

327 moments · 2020-03-09T00:15:08Z CE – 2026-11-02T20:11:21Z CE · by @athan · @athan

#411 · Idle sessions end with a page left open; tokens compare in constant time

  • timeline-app
  • pull request
  • security

## What changes **Idle limit.** `Auth.session` takes `{ touch }`. The live-update stream (`server/live.mjs`, its first check and its periodic re-checks) and revision polling (`GET /api/timelines/:id/revision`, which the page uses while the stream is reconnecting, and which the desktop app always uses) pass `touch: false`. Those requests still need a live session, but they don't refresh its last-seen time. So the one-day idle limit applies to a tab left open, and isn't held off until the 14-day absolute limit. Everything a person does still counts as activity: opening pages, saving, and any other API call. **Constant-time token comparison.** The session's CSRF token (`Auth.require`) and the sign-in page's `oc_login` nonce (`Auth.requireLogin`) are compared with the new `sameToken`, which uses `timingSafeEqual` and refuses a missing value or one of a different length, instead of `!==`. `docs/authentication.md` describes the idle rule. ## Tests - `test/administration-postgres.mjs`: with the session last seen 23 hours ago, polling the revision leaves it idle, and opening the timeline refreshes it. This fails without the change. - `test/auth.test.mjs`: `sameToken`, and `Auth.require` with a right, missing or wrong token. - Locally: `administration-postgres`, `account-security-postgres` and the unit tests pass.

Sources

Open #411 · Idle sessions end with a page left open; tokens compare in constant time in the timeline