Session cookie lifespan

[harnash]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Network project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe the bug

I'm not 100% sure but looking at the code I might be right.
Kratos has a configurable session lifespan via session.lifespan configuration option. Default value is 24hrs. When setting this option to something longer than 30 days may cause session to be invalidated prematurely.

We have this settings set to 180 days however we have reports of users being logged out prematurely.

Looking at the code we have found that session lifespan is properly set in:

• cookie expiration date in a browser
• session expiration date in the sessions table in a database

Kratos uses https://github.com/ory/sessions which is a fork of https://github.com/gorilla/sessions to store and encode/decode session cookies. This library uses internally stored (in a encoded cookie) timestamp to verify cookie validity. Kratos sets cookie TTL here https://github.com/ory/kratos/blob/master/driver/registry_default.go#L512 however codecs that https://github.com/ory/sessions still have default value set which is set here https://github.com/ory/sessions/blob/master/store.go#L54. I believe that whenever cookie is being decoded and internal timestamp is 30 days old or older it will not be decoded properly and it will cause user to be logged out.

Reproducing the bug

1. Set session.lifespan to a value greater than 30 days
2. Issue a cookie that is valid and has timestamp set to a date 30 days than current time (either modify server time or generate cookie with manually set timestamp)
3. Check if /sessions/whoami recognizes a given cookie (it should return http status 401)

Relevant log output

No response

Relevant configuration

session:
    lifespan: 4320h

Version

v0.10.0

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Kubernetes

Additional Context

I've replicated this issue by synthetically generating cookies with tempered timestamps and I can concur that this is actually happening.

[harnash]

Potential fix: #3209