mlibrary / keycard / 139

100%

main: 100%

Pull #14

travis-ci

Expire sessions and support CSRF tokens

There are two pieces here, required to allow mixed-mode applications
with browser and non-browser clients:

 1. Sessions are expired if there has been no request within the
    configurable timeout
 2. CSRF tokens are preserved during the session reset to allow for
    a GET to a login form, followed by a POST with the session-based
    token and form parameter to match.

The validate_session method should be called as before_action before
the authenticate! action. This also changes the precedence in the
default Notary to use a token before a session user ID.

Re: PFDR-223

605 of 605 new or added lines in 17 files covered. (100.0%)

1348 of 1350 relevant lines covered (99.85%)

4.62 hits per line