fa/breadcrumb-the-shire
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(session): preserve intended URL across session timeout and add expiry warning dialog

Browse Source 
When a session expires, the user's current URL is now captured and restored
after re-authentication (via remember-me cookie or manual login), instead of
always redirecting to the dashboard. A JavaScript session warning dialog
appears ~2 minutes before idle timeout, allowing users to extend their session
with a single click. Includes open-redirect prevention via URL validation,
Microsoft SSO callback support, and 33 unit tests.

Refs: SESSION-REDIRECT-PRESERVE-001

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Felix Schneider
2026-03-13 14:28:49 +01:00
parent a3045fa95e
commit 04995e3712
18 changed files with 1333 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
templates/default.phtml
View File

@@ -2,6 +2,7 @@
use MintyPHP\Buffer;
use MintyPHP\Http\RequestContext;
use MintyPHP\Service\Settings\SettingsSessionGateway;
use MintyPHP\Session;
$defaultTitle = appTitle();
@@ -10,6 +11,11 @@ $theme = currentTheme();
$primaryVars = appPrimaryCssVars();
$csrfKey = Session::$csrfSessionKey;
$csrfToken = (string) ($_SESSION[$csrfKey] ?? '');
$isLoggedIn = !empty($user['id']);
$sessionIdleSeconds = 0;
if ($isLoggedIn) {
$sessionIdleSeconds = app(SettingsSessionGateway::class)->getSessionIdleTimeoutSeconds();
}
$telemetryEnabled = frontendTelemetryEnabled();
$telemetrySampleRate = frontendTelemetrySampleRate();
$telemetryAllowedEvents = implode(',', frontendTelemetryAllowedEvents());
@@ -38,6 +44,13 @@ if ($bufferTitle !== '') {
data-telemetry-allowed-events="<?php e($telemetryAllowedEvents); ?>"
data-telemetry-csrf-key="<?php e($csrfKey); ?>"
data-telemetry-csrf-token="<?php e($csrfToken); ?>"
<?php if ($isLoggedIn && $sessionIdleSeconds > 0): ?>
data-session-idle-seconds="<?php e((string) $sessionIdleSeconds); ?>"
data-session-ping-url="<?php e(lurl('admin/session-ping/data')); ?>"
data-session-logout-url="<?php e(lurl('logout')); ?>"
data-session-csrf-key="<?php e($csrfKey); ?>"
data-session-csrf-token="<?php e($csrfToken); ?>"
<?php endif; ?>
class="no-js"
<?php if ($primaryVars !== ''): ?>style="<?php e($primaryVars); ?>" <?php endif; ?>
>
@@ -76,6 +89,10 @@ if ($bufferTitle !== '') {
<script src="<?php e(assetVersion('vendor/fslightbox/fslightbox.js')); ?>"></script>
<?php require __DIR__ . '/partials/app-confirm-dialog.phtml'; ?>
<?php if ($isLoggedIn && $sessionIdleSeconds > 0): ?>
<?php require __DIR__ . '/partials/app-session-warning-dialog.phtml'; ?>
<script type="module" src="<?php e(assetVersion('js/components/app-session-warning.js')); ?>"></script>
<?php endif; ?>
<script type="module" src="<?php e(assetVersion('js/app-init.js')); ?>"></script>
</body>