Require session timeout for Source Interface and Document Interface

[runasand]

A journalist can be logged in to the Document Interface, remain inactive for 10 hours, and then continue working without the system requiring her to log back in again. The same is true for sources on the Source Interface. If possible, consider timing out sessions that have been inactive for a long time.

[garrettr]

This was suggested and debated in an earlier issue.

To recap: this is actually a little tricky. The current cookies are "session" cookies, which means they do not have an "Expires:" value set. Therefore, they only last as long as the user's browser session. The easiest way to time out sessions is to have the cookies expire. Unfortunately, this means they will no longer be session cookies, in which case Firefox will write them to disk. We intentionally use session cookies, which are stored in memory and never written to disk, as an anti-forensic measure.

It is possible that one of the Tor Browser patches might change this behavior in a way that could mitigate this forensic concern, but I haven't had time to look into it.

[garrettr]

Note that the link to the Firefox implementation in the above comment is no longer exactly correct (although it is close) because the exact line number has changed due to modifications to the file since the last comment. If you are looking for the code, look around this comment:

// if it's a non-session cookie and hasn't just been read from the db, write it out.

[heartsucker]

@redshiftzero Hackathon candidate.

[redshiftzero]

As described in this comment, this is not trivial, but #1494 would be a good starting point.

[heartsucker]

Actually, my old change (#1494) doesn't alter the session/persistent nature of the cookies. It just adds and explicit timeout to the cookie. This covers the case where the browser is left open so that it will time out for the next request. I don't think @garrettr's comment applies to mine.

[redshiftzero]

I took a look at how Tor Browser handles cookies. In Tor Browser, network.cookie.lifetimePolicy is set to 2:

This means that Tor Browser will clear all cookies (privacy.clearOnShutdown.cookies is also set to true) when the browser is closed, which addresses the concerns raised in this comment. Also recall that we already instruct sources in the interface to close their browser after logout which will ensure that any SecureDrop-related cookies are removed. Thus, we can safely implement a session timeout on both interfaces as is done in #1494.

[redshiftzero]

Done in #1494