Revoke/expire sessions?

[CSchank]

In the default IHP authentication module, is there any way to revoke sessions? Perhaps after a certain amount of time?

[amitaibu]

I see here an example in the code:

ihp/IHP/FrameworkConfig.hs

Lines 289 to 290 in 16a9275

	-- __Example: Set max age to 90 days__
	-- > sessionCookie = defaultIHPSessionCookie { Cookie.setCookieMaxAge = Just (fromIntegral (60 * 60 * 24 * 90)) }

So I think on your Config.hs you could

sessionCookie = defaultIHPSessionCookie { Cookie.setCookieMaxAge = Just (fromIntegral (60 * 60 * 24 * 90)) }
option sessionCookie

[CSchank]

Thank you! Is there a way to enforce that current cookies expire? Or will this only work for new logins?

[amitaibu]

I don't think existing cookies can be changed.
But you can expire all of them by changing the session https://github.com/digitallyinduced/ihp-boilerplate/blob/30f5fd22a5d3266bf6840b94ce9a0e11c238e118/flake.nix#L119-L122