fix: enforce configured session timeout

2026-09-21 19:55:28 +08:00
parent 5ceba1104d
commit 75d6e45080
2 changed files with 14 additions and 3 deletions
@@ -339,12 +339,16 @@ func (s *Server) session(w http.ResponseWriter, r *http.Request) {
 		writeJSONError(w, http.StatusNotFound, "user or password is wrong")
 		return
 	}
-	token, err := auth.NewToken(a.Username)
+	ttl := 365 * 24 * time.Hour
+	if s.SessionTimeout > 0 {
+		ttl = time.Duration(s.SessionTimeout) * time.Minute
+	}
+	token, err := auth.NewTokenWithTTL(a.Username, ttl)
 	if err != nil {
 		writeJSONError(w, http.StatusInternalServerError, "failed to create token")
 		return
 	}
-	expires := time.Now().Add(365 * 24 * time.Hour)
+	expires := time.Now().Add(ttl)
 	http.SetCookie(w, &http.Cookie{Name: "JWT", Value: token, Path: "/", Expires: expires, HttpOnly: true})
 	http.SetCookie(w, &http.Cookie{Name: "user", Value: a.Username, Path: "/", Expires: expires})
 	w.WriteHeader(http.StatusCreated)