From 7c142ebd20c3f7d6e14ad2827f74887d93dce606 Mon Sep 17 00:00:00 2001 From: momo3404 Date: Mon, 6 Oct 2025 11:11:57 -0600 Subject: [PATCH 1/2] Enable session timeout after 90 mins of inactivity --- app/models/user.rb | 4 ++-- config/initializers/devise.rb | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/models/user.rb b/app/models/user.rb index e3ecccf039..94d0035eec 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -63,9 +63,9 @@ class User < ApplicationRecord # Devise # Include default devise modules. Others available are: # :token_authenticatable, :confirmable, - # :lockable, :timeoutable and :omniauthable + # :lockable and :omniauthable devise :invitable, :database_authenticatable, :registerable, :recoverable, - :rememberable, :trackable, :validatable, :omniauthable, + :rememberable, :trackable, :validatable, :omniauthable, :timeoutable, omniauth_providers: %i[shibboleth orcid] # default user language to the default language diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb index 1cb771e8f6..8649665ccf 100755 --- a/config/initializers/devise.rb +++ b/config/initializers/devise.rb @@ -172,7 +172,7 @@ # ==> Configuration for :timeoutable # The time you want to timeout the user session without activity. After this # time the user will be asked for credentials again. Default is 30 minutes. - config.timeout_in = 3.hours + config.timeout_in = 90.minutes # If true, expires auth token on session timeout. # config.expire_auth_token_on_timeout = false From fc31d93b1b3ae2227926984d638ed463a86ee748 Mon Sep 17 00:00:00 2001 From: momo3404 Date: Mon, 6 Oct 2025 11:49:16 -0600 Subject: [PATCH 2/2] Add changelog entry --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 74281a792e..5c379dbc2f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## v5.0.2 - Bump Ruby to v3.1.4 and use `.ruby-version` in CI [#3566](https://github.com/DMPRoadmap/roadmap/pull/3566) +- Enable session timeout after 90 minutes of inactivity [#3568](https://github.com/DMPRoadmap/roadmap/pull/3568) ## v5.0.1 - Updated seeds.rb file for identifier_schemes to include context value and removed logo_url and idenitifier_prefix for Shibboleth (as it was causing issues with SSO). [#3525](https://github.com/DMPRoadmap/roadmap/pull/3525)