Merge pull request #56239 from nextcloud/backport/56215/stable26

[stable26] feat(EphemeralSessions): Introduce lax period

Author: nickvergessen

lib/private/AppFramework/Middleware/FlowV2EphemeralSessionsMiddleware.php

@@ -11,25 +11,38 @@
 use OC\Core\Controller\ClientFlowLoginV2Controller;
 use OC\Core\Controller\TwoFactorChallengeController;
 use OCP\AppFramework\Middleware;
+use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\Authentication\TwoFactorAuth\ALoginSetupController;
 use OCP\ISession;
 use OCP\IUserSession;
 
 // Will close the session if the user session is ephemeral.
 // Happens when the user logs in via the login flow v2.
 class FlowV2EphemeralSessionsMiddleware extends Middleware {
+	private const EPHEMERAL_SESSION_TTL = 5 * 60; // 5 minutes
+
 	public function __construct(
 		private ISession $session,
 		private IUserSession $userSession,
 		private ControllerMethodReflector $reflector,
+		private ITimeFactory $timeFactory,
 	) {
 	}
 
 	public function beforeController($controller, $methodName) {
-		if (!$this->session->get(ClientFlowLoginV2Controller::EPHEMERAL_NAME)) {
+		$sessionCreationTime = $this->session->get(ClientFlowLoginV2Controller::EPHEMERAL_NAME);
+
+		// Not an ephemeral session.
+		if ($sessionCreationTime === null) {
+			return;
+		}
+
+		// Lax enforcement until TTL is reached.
+		if ($this->timeFactory->getTime() < $sessionCreationTime + self::EPHEMERAL_SESSION_TTL) {
 			return;
 		}
 
+		// Allow certain controllers/methods to proceed without logging out.
 		if (
 			$controller instanceof ClientFlowLoginV2Controller &&
 			($methodName === 'grantPage' || $methodName === 'generateAppPassword')

lib/private/Authentication/Login/FlowV2EphemeralSessionsCommand.php

@@ -9,20 +9,22 @@
 namespace OC\Authentication\Login;
 
 use OC\Core\Controller\ClientFlowLoginV2Controller;
+use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\ISession;
 use OCP\IURLGenerator;
 
 class FlowV2EphemeralSessionsCommand extends ALoginCommand {
 	public function __construct(
 		private ISession $session,
 		private IURLGenerator $urlGenerator,
+		private ITimeFactory $timeFactory,
 	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
 		$loginV2GrantRoute = $this->urlGenerator->linkToRoute('core.ClientFlowLoginV2.grantPage');
 		if (str_starts_with($loginData->getRedirectUrl() ?? '', $loginV2GrantRoute)) {
-			$this->session->set(ClientFlowLoginV2Controller::EPHEMERAL_NAME, true);
+			$this->session->set(ClientFlowLoginV2Controller::EPHEMERAL_NAME, $this->timeFactory->getTime());
 		}
 
 		return $this->processNextOrFinishSuccessfully($loginData);