Merge lp:~roadmr/canonical-identity-provider/openid-token-reaper into lp:canonical-identity-provider/release

[Daniel Manrique]

track openid token creation time and reap tokens (and payloads) over 1 day old to prevent sessions from growing boundlessly

track openid token creation time and reap tokens (and payloads) over 1 day old to prevent sessions from growing boundlessly

=== modified file 'src/identityprovider/views/server.py'
--- src/identityprovider/views/server.py	2018-05-28 19:44:56 +0000
+++ src/identityprovider/views/server.py	2018-07-11 22:22:36 +0000
@@ -4,6 +4,7 @@
 
 import logging
 import re
+import time
 import urllib
 import urlparse
 from datetime import timedelta
@@ -225,6 +226,17 @@
         token = generate_random_string(16)
         request.session[token] = signed.dumps(orequest,
                                               settings.SECRET_KEY)
+        # Ensure session has expirations
+        if 'token_expirations' not in request.session:
+            request.session['token_expirations'] = {}
+        now_timestamp = int(time.time())
+        # Remove expired tokens
+        tokex = request.session['token_expirations']
+        [request.session.pop(token, None) and tokex.pop(token, None)
+            for token, expiration in tokex.items()
+            if now_timestamp > expiration]
+        # All new tokens get an expiration 24 hours into the future
+        tokex[token] = now_timestamp + 86400  # seconds
         response = HttpResponseRedirect(
             reverse('server-decide', kwargs=dict(token=token)))
     referer = request.META.get('HTTP_REFERER')