Skip to content

Quality: Invalid SESSION_MAX_AGE_SECS is silently ignored, causing wrong session lifetime #15367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Nam0101 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Quality: Invalid SESSION_MAX_AGE_SECS is silently ignored, causing wrong session lifetime #15367

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions gear/gear/auth_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
import logging
import os
import secrets
from typing import Optional
Expand All @@ -16,8 +15,10 @@ def max_age():
if (s := os.getenv('SESSION_MAX_AGE_SECS')) is not None:
try:
MAX_AGE_SECS = int(s)
except ValueError:
logging.exception("Unable to interpret SESSION_MAX_AGE_SECS as an integer.")
except ValueError as e:
raise ValueError(f"Invalid SESSION_MAX_AGE_SECS={s!r}; expected integer seconds") from e
if MAX_AGE_SECS <= 0:
raise ValueError('SESSION_MAX_AGE_SECS must be > 0')
Comment on lines 16 to +21
Copy link

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MAX_AGE_SECS is assigned before the <= 0 validation. If SESSION_MAX_AGE_SECS is 0/negative, this function raises, but the global remains set to an invalid value; if the exception is caught and max_age() is called again, it will skip re-initialization and return the invalid cached value. Consider validating in a local variable first (or resetting MAX_AGE_SECS back to None before raising) so the cache can’t be left in a bad state.

Copilot uses AI. Check for mistakes.

if MAX_AGE_SECS is None:
# Default value, no env. variable set: 2592000 seconds (30 days)
Expand Down
Loading