RFC re: 798960 -- session timeout-induced bug

Scott Seago sseago at redhat.com
Fri Mar 2 15:24:57 UTC 2012


On 03/02/2012 09:30 AM, Matt Wagner wrote:
> On Fri, Mar 02, 2012 at 09:12:35AM -0500, wes hayutin wrote:
>> On 03/01/2012 06:11 PM, Mo Morsi wrote:
> <snip>
>>> Hrm why is the inactivity timeout causing issues w/ QE? Do any of the
>>> automated tests incorporate a delay>   15 minutes?
>> um.. running a build/push and waiting for it would take longer than 15 min.
>> I'm always of the opinion qe automation should work around any issues
>> introduced by devel if there is a bug.
>>
>> So.. I mentioned it in a bug, but I'm not expecting *any* fixes for
>> qe automation's sake.
> Yes, it's a legitimate bug outside of QE as well that should be fixed in
> some way. I apologize if I came across as suggesting otherwise.
>
>>> Regardless, would tailoring the behaviour to the rails environment solve
>>> the issue? eg. when running the app in 'production' we incorporate this
>>> time out where as it is disabled in the 'test' environment.
>>>
>>>      -Mo
>>>
>> Changing the default behaviour for testing is always a bad idea IMHO
>> At any rate.. I just need some time to find the appropriate fix for
>> the auto.
> I've been burned before by well-intentioned code that changes its
> behavior depending on production, so I'm moderately paranoid of that
> pattern.
>
> I'll take a look at what it will take to fix this bug "for real" versus
> reverting the new feature that causes it.
>
> -- Matt
So to Hugh's point of it being a security hole, does this mean we've got 
to find a way to timeout even _with_ intervening backbone updates? I'd 
think so, otherwise an open page would keep the session from timing out 
for days.

Scott




More information about the aeolus-devel mailing list