Skip to content

[v16] fix: Take TTL into account when renewing sessions #49769

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
codingllama merged 2 commits into from
Dec 5, 2024
Merged

[v16] fix: Take TTL into account when renewing sessions #49769

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8639299
fix: Take TTL into account when renewing sessions
codingllama Dec 3, 2024
34f36de
Update comments
codingllama Dec 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 22 additions & 5 deletions web/packages/teleport/src/services/websession/websession.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,9 +26,8 @@ import { KeysEnum, storageService } from 'teleport/services/storageService';
import makeBearerToken from './makeBearerToken';
import { RenewSessionRequest } from './types';

// Time to determine when to renew session which is
// when expiry time of token is less than 3 minutes.
const RENEW_TOKEN_TIME = 180 * 1000;
const MAX_RENEW_TOKEN_TIME = 180000; // 3m
const MIN_RENEW_TOKEN_TIME = 30000; // 30s
const TOKEN_CHECKER_INTERVAL = 15 * 1000; // every 15 sec
const logger = Logger.create('services/session');

Expand Down Expand Up @@ -146,11 +145,14 @@ const session = {
return false;
}

// Renew session if token expiry time is less than 3 minutes.
// Renew session if token expiry time is less than renewTime (with MIN_ and
// MAX_RENEW_TOKEN_TIME as floor and ceiling, respectively).
// Browsers have js timer throttling behavior in inactive tabs that can go
// up to 100s between timer calls from testing. 3 minutes seems to be a safe number
// with extra padding.
return this._timeLeft() < RENEW_TOKEN_TIME;
let renewTime = Math.min(this._ttl() / 10, MAX_RENEW_TOKEN_TIME);
renewTime = Math.max(renewTime, MIN_RENEW_TOKEN_TIME);
return this._timeLeft() < renewTime;
},

_renewToken(req: RenewSessionRequest = {}, signal?: AbortSignal) {
Expand Down Expand Up @@ -214,6 +216,21 @@ const session = {
return delta;
},

_ttl() {
const token = this._getBearerToken();
if (!token) {
return 0;
}

let { expiresIn, created } = token;
if (!created || !expiresIn) {
return 0;
}

expiresIn = expiresIn * 1000;
return expiresIn;
},

_shouldCheckStatus() {
if (this._getIsRenewing()) {
return false;
Expand Down