[eliasjpr]

What

• Store#load_from adopts a session only while session.valid?. An expired one is ignored and the request starts a fresh session.
• expires_at is required when a session is deserialised (JSON::Field(presence: true) plus after_initialize): a signed or stored payload without it fails to load, so no store adopts it, instead of the property default giving it a fresh expiry. Payloads written by released versions always carry the field; the serialised format is unchanged (no expires_at_present key). A subclass that overrides after_initialize must call super.
• RedisStore#[]? deletes an expired session it reads, as MemoryStore already did.

Why (gate-2 audit P1-10)

A cookie's Expires attribute is only advice to the browser. A copied CookieStore pair carries its own signed expires_at, and nothing read it on the way in, so a replayed cookie kept a visitor signed in long after the timeout.

I reproduced this against azu master (0.8.1) and session master with require "session/azu": timeout = 2.seconds, then the same cookies replayed 3 s later still answered context.session.user_id == 42. With this change they get a new, empty session.

The check sits in load_from, so it covers every store (MemoryStore already refused expired entries; RedisStore did not look at expires_at either).

Tests

• spec/store_spec.cr: an expired, correctly signed cookie session is not loaded (red before the fix), a live one still is; a signed cookie payload without expires_at is not loaded (red before the follow-up); with Redis (REDIS_AVAILABLE), an expired session still present in Redis is not loaded and its key is deleted (the delete assertion was red before the follow-up), and a live one still loads.
• spec/base_spec.cr: deserialising without expires_at raises JSON::SerializableError; the serialised payload still round-trips.
• crystal spec with a local Redis: 528 examples, 0 failures (Crystal 1.22.1). crystal tool format --check src spec scripts examples: clean. scripts/check_docs.cr (README, UPGRADE, docs): 157 snippets, 0 failed.

Behaviour change

This is a user-visible behaviour change, documented in UPGRADE.md:

• A RedisStore session now ends at expires_at (creation, or the last regeneration, plus timeout) even while the visitor keeps using it, when sliding_expiration is false (the default). Before, every save ran SETEX, which reset the Redis TTL, and nothing read expires_at, so an active session lived indefinitely. config.sliding_expiration = true keeps active sessions alive (each request moves expires_at to timeout from now).
• A replayed CookieStore cookie past its expires_at now gets a fresh, empty session.
• A stored or signed payload without expires_at no longer loads.

Not in this PR

An absolute session lifetime and server-side logout/revocation for CookieStore (a revocation counter or generation claim) are design decisions, listed as open questions.

Semver: patch (security fix; no API change, but the behaviour change above is visible to users). No minor/major release marker in the commits.

---

Generated by Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}