Fix StaySignedIn mechanism

[Lucas-C]

Issue symptoms

When performing a login with the longlastingsessionform checkbox set,
the login succeeds but the session lasts less than 1 hour.

Issue analysis

After a successful login, shaarli performs a redirect in LoginController->login().

During this redirect operation, the following state is lost:

1. SessionManager->staySignedIn is switched from true to false
2. SessionManager->session['expires_on'] is reset to a short (1 hour) session, due to the call SessionManager->extendSession() made from LoginManager->checkLoginState() in index.php

The consequence is that the SessionManager->session['expires_on'] is never persisted to 1 year value, only to a 1 hour value.

Fix description

First, there is an issue with SessionManager->$staySignedIn that is always initialized to false.

The fix there was to figure if we are in a long-lasting session based on $this->session['expires_on'],
and in this case set it to true in SessionManager->initialize().

The other part of the fix was to ensure that SessionManager->session['expires_on'] is correctly persisted between the call to LoginController->login(), the redirect and the page reload.

My solution was to simply perform the calls to sessionManager->destroy(), sessionManager->start() & sessionManager->regenerateId() a bit earlier in LoginController->renewUserSession().

There may be other solutions to solve this problem, but this seemed the cleanest to me.
Suggestions for alternative fixes are welcome.

Note that there is also this related existing issue to redesign the login management code: #1150

[Lucas-C]

Another closed issue related to my persistent sign-in problem: #1228

I just figured that in my case the issue was also caused by this PHP configuration value: session.gc_maxlifetime: 1440 seconds (default value = 24min)

I will try to continue working on this and provide more information if I can.

Maybe in the end the best/first thing to do would be to simply document the impact of PHP session.gc_maxlifetime setting on Shaarli in Shaarli own documentation

[Lucas-C]

IMHO this PR is ready for review & merging.

This PR includes:

• the fix detailed in the description
• an extra warning log produced if session.gc_maxlifetime is too low
• the following new documentation section for https://shaarli.readthedocs.io/en/master/Server-configuration.html:

Configuring session max duration

Shaarli relies on PHP native session handling based on $SESSION. A base Shaarli session lasts 1 hour.

Due to this, the session duration is limited by the value of session.gc_maxlifetime (unit: minutes) set in your PHP configuration (e.g. php.ini). Its default value is 24min.

If you want to benefit from Shaarli stay-signed-in feature that only terminates your session after one year of inactivity, you should set session.gc_maxlifetime to 525600 (1 year).

[Lucas-C]

I have experienced another session reset and thought this bug was not solved,
but in the end I figured this was due to the feature that protects sessions from IP-change (session_protection_disabled": false setting).
😅

I got a session lasting several hours after that, so I think this PR definitively solves the problem.

[nodiscc]

Hi,

I don't understand what this is supposed to fix. I can't reproduce the problem on my local instance (apache + php-fpm, Debian 12)

Are you able to reproduce the problem on a stock shaarli installation? With or without session_protection_disabled ? Does your client IP change regularly? Which installation method? Anything in the logs? Any specific PHP config?

[Lucas-C]

Hi.

I don't understand what this is supposed to fix. I can't reproduce the problem on my local instance (apache + php-fpm, Debian 12)

What is your value for session.gc_maxlifetime?

Are you able to reproduce the problem on a stock shaarli installation?

I haven't tried.

With or without session_protection_disabled ?

I think problem happens with both, but I intially had session protection enabled.

Does your client IP change regularly?

Yes, somehow.

Which installation method?

Manual and relatively old.

Anything in the logs?

Which logs?
This PR adds slightly improve the application logs for this reason: to make it easier to track Shaarli login process.

Any specific PHP config?

None that I'm aware of, but I can check specific settings if you want?

[nodiscc]

What is your value for session.gc_maxlifetime?

/etc/php/8.2/fpm/php.ini:session.gc_maxlifetime = 1440

Does your client IP change regularly?

Yes, somehow.
With or without session_protection_disabled ?
I think problem happens with both, but I intially had session protection enabled.

I think there is your problem. When  "stay signed in"/Remember me is enabled at login, the session/cookie should persist for 1 year. Unless the client that holds the cookie changes IP address, as seen from the Shaarli server. This is a security measure against cookie/session stealing (side note, it is also an effective defense against an attacker trying to exploit the recently discovered XSS vulns to steal the session cookie, if they tried to reuse it from another client it would get invalidated).

If your client IP address changes regularly, the only way to stay signed in is "session_protection_disabled": "true" (https://shaarli.readthedocs.io/en/master/Shaarli-configuration.html#security)

https://deepwiki.com/search/how-long-does-the-sessioncooki_0715dc79-57b9-476c-8bc7-5602bdef14a0?mode=fast

Please try running v0.16.2 with no changes to the code, disabling session protection, login with "Stay signed in" enabled, and use shaarli for a while, then confirm or not if it solves your problem.