enh(auth): make session lifetime configurable for the normal (surveillance) user

Adds `normal_session_expiry_hours` to motioneye.conf so the normal (surveillance) user can configure the session lifetime, with a default of 30 days (720h) and a minimum of 1 hour.

Author: Marijn0

motioneye/extra/motioneye.conf.sample

@@ -94,3 +94,6 @@ add_remove_cameras true
 
 # overrides the hostname (useful if motionEye runs behind a reverse proxy)
 #server_name motionEye
+
+# lifetime in hours of the session cookie for the normal (surveillance) user, minimum 1 hour
+normal_session_expiry_hours 720

motioneye/handlers/base.py

@@ -22,7 +22,7 @@
 
 from tornado.web import HTTPError, RequestHandler
 
-from motioneye import VERSION, config, template
+from motioneye import VERSION, config, settings, template
 from motioneye.utils.authstate import verify_hmac_signature
 
 __all__ = ('BaseHandler', 'NotFoundHandler', 'ManifestHandler')
@@ -35,12 +35,18 @@
 _session_store: dict = {}
 
 
+def session_expiry_seconds(user_type):
+    if user_type == 'normal':
+        return max(1, settings.NORMAL_SESSION_EXPIRY_HOURS) * 3600
+    return _SESSION_EXPIRY_SECONDS
+
+
 def create_session(user_type):
     """Create a secure session id with expiry."""
     session_id = token_hex(32)
     _session_store[session_id] = {
         'user': user_type,
-        'expires': time() + _SESSION_EXPIRY_SECONDS,
+        'expires': time() + session_expiry_seconds(user_type),
     }
     return session_id
 

motioneye/handlers/login.py

@@ -24,7 +24,7 @@
 from argon2.exceptions import InvalidHash, VerificationError, VerifyMismatchError
 
 from motioneye import config
-from motioneye.handlers.base import BaseHandler, create_session
+from motioneye.handlers.base import BaseHandler, create_session, session_expiry_seconds
 from motioneye.utils.authstate import (
     PasswordHashState,
     build_password_hash_state,
@@ -143,7 +143,7 @@ def post(self) -> None:
         self.set_secure_cookie(
             'user',
             session_id,
-            expires_days=1,
+            expires_days=session_expiry_seconds(user_type) / 86400,
             httponly=True,
             secure=should_use_secure_cookie(self),
             samesite='Strict',

motioneye/settings.py

@@ -140,3 +140,6 @@
 
 # provides the possibility to override the hostname
 SERVER_NAME = socket.gethostname()
+
+# lifetime in hours of the session cookie for the normal (surveillance) user, minimum 1 hour
+NORMAL_SESSION_EXPIRY_HOURS = 720