FEATURE: added USE_ROLLING_SESSIONS

Author: cmalek

doc/source/configuration.rst

@@ -224,6 +224,11 @@ These settings configure the login form and session handling.
     ``0``, no expiry.   If :envvar:`USE_ROLLING_SESSIONS` is ``True``, this
     value is used to reset the session lifetime on every request.
 
+.. envvar:: USE_ROLLING_SESSIONS
+
+    If ``True``, session lifetime will be reset to :envvar:`SESSION_MAX_AGE` on
+    every request.  Defaults to ``False``.
+
 .. envvar:: SECRET_KEY
 
     **Required** The secret key to use for the session. Defaults to ``SESSION_SECRET``.

etc/environment.txt

@@ -7,6 +7,7 @@ LDAP_BASEDN=ou=users,dc=example,dc=com
 
 # COOKIE_NAME=nginxauth
 # SESSION_MAX_AGE=0
+# USE_ROLLING_SESSIONS=False
 # SESSION_BACKEND=memory
 # REDIS_URL=redis://localhost
 # REDIS_PREFIX=nginx_ldap_auth.

nginx_ldap_auth/settings.py

@@ -40,6 +40,9 @@ class Settings(BaseSettings):
     secret_key: str
     #: The maximum age of a session cookie in seconds
     session_max_age: int = 0
+    #: Reset the session lifetime to :py:attr:`session_max_age` every time the
+    #: user accesses the protected site
+    use_rolling_session: bool = False
     #: Session type: either ``redis`` or ``memory``
     session_backend: Literal['redis', 'memory'] = 'memory'
     #: If using the Redis session backend, the DSN on which to connect to Redis.