Autologout cookie is not secure

Patch #11 works fine, but REQUEST_TIME is deprecated, so I added a small fix for that.

The last submitted patch, 12: 3308456-12.patch, failed testing. View results →

I added the post update hook for the new settings, so existing users have values set and they only need to export the configuration (to have it set "default"). And also applied the changes from patch in comment #12 ✨ Autologout cookie is not secure Needs review
The testing is now done via GitLab CI and test are passing, so setting the status to needs review and "hidding" the patch files, as the issue fork exists and all changes should be done there.

When the user logs in the cookie correctly sets values of the cookie. The problem comes when JS sets a new cookie cookies.set("Drupal.visitor.autologout_login", Math.round((new Date()).getTime() / 1000));this resets all values to None.

Looking into fixing it.

Now the cookie setting in JS also adds the configurations.

Good catch for the JS configuration. Just removed the casting from int as it's not necessary and updated post update hook to use correct variable for lifetime. The code works, it sets the cookie base on the settings defined in the configuration, so marking this as RTBC.

This is working really, except that the settings form always reverts back to the default value for cookie lifetime. To replicate, change the value to `0` and save. The form will show `31536000`.

There appears to be something wrong with the logic. After the initial timeout, the user is presented with a dialog on every page request. I have it set to "Logout user regardless of activity".

Updated code for issue to set cookie lifetime to 0

I figured out why the timer never gets reset after the initial one times out when the module is configured to "Logout user regardless of activity". The cookie with HttpOnly configured to true cannot be accessed by js, so var login_time = cookies.get("Drupal.visitor.autologout_login"); is undefined.

So the HttpOnly setting is currently incompatible with the "Logout user regardless of activity" setting.

Hello @jonraedeke,
I can have a look into js undefined error.

I think we can remove the HttpOnly from this patch and keep the rest.
Do let us know your opinion @jonraedeke