User can not be loaded from other_sources when session expires in current request

[infernalmaster]

I'm using such submodules:

[:remember_me, :reset_password, :user_activation, :brute_force_protection, :session_timeout, :activity_logging]

I logged in with remember_me option. And leaved tab opened for more that 1 hour. Then I reloaded page and was redirected to login page. Then I reloaded page again and I was logged in. So I started digging code and found this:

sorcery/lib/sorcery/controller/submodules/session_timeout.rb

Line 38 in 4e3fcdb

def validate_session

        base.prepend_before_action :validate_session

          def validate_session
            session_to_use = Config.session_timeout_from_last_action ? session[:last_action_time] : session[:login_time]
            if session_to_use && sorcery_session_expired?(session_to_use.to_time)
              reset_sorcery_session
              # USER IS DEFINED THERE
              @current_user = nil     
            else
              session[:last_action_time] = Time.now.in_time_zone
            end
          end

sorcery/lib/sorcery/controller.rb

Line 82 in a873231

def current_user

      def current_user
        unless defined?(@current_user)
          # USER IS DEFINED SO THIS WILL BE SKIPPED IN CURRENT REQUEST
          @current_user = login_from_session || login_from_other_sources || nil
        end
        @current_user
      end

So maybe remove_instance_variable :@current_user if defined? @current_user will be better option. And IMHO this should be done everywhere where user is settled to nil.

And also I found this place. I don't understand the reason of that ELSE block:

sorcery/lib/sorcery/controller/submodules/remember_me.rb

Line 70 in 4e3fcdb

@current_user = false

[Ch4s3]

would you be willing to submit a quick PR for this @infernalmaster?

[infernalmaster]

I'm not very satisfied with my PR, because I think that check defined?(@current_user) inside current_user method is not very obvious solution. I would better rewrite that logic but I don't have enogh time to do it right and don't want to break something