From 0a70b74b55b9f21aae4f35f1419af56c1fd9207a Mon Sep 17 00:00:00 2001 From: Petr Date: Thu, 25 Jun 2026 21:30:20 +0200 Subject: [PATCH] fix: wire session_ttl config into Rack session cookie expiration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The admin.session_ttl value was defined in defaults, template, and documentation but never read — sessions had no expiration. Pass it as expire_after to Rack::Session::Cookie. A value <= 0 means persistent (until browser close), matching the documented behaviour. --- lib/volumen/server.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/volumen/server.rb b/lib/volumen/server.rb index e7846c6..a0f7226 100644 --- a/lib/volumen/server.rb +++ b/lib/volumen/server.rb @@ -23,10 +23,12 @@ module Volumen # Returns a configured subclass bound to a specific config + store. def self.configured(config:, store:) secret = session_secret(config) + ttl = config.admin["session_ttl"].to_i + ttl = nil if ttl <= 0 Class.new(self) do set :volumen_config, config set :volumen_store, store - set :sessions, httponly: true, same_site: :strict + set :sessions, httponly: true, same_site: :strict, expire_after: ttl set :session_secret, secret end end