- Ya
- 7 Agosti 2026, 16:57 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 67f9fcd
getSession() refreshed the Redis TTL on every read, and OTKPreAuthFilter resolves the session before any controller runs — so every API call renewed the session. Frontends poll on timers that never stop (kamo-internal's rights refresh alone fires every 5 minutes, forever), which pinned the TTL near full and made idle logoff impossible: a tab left open overnight was still signed in. Callers now report the user's idle time in X-Kamo-Idle-Ms, published per request by SessionActivityFilter and read via SessionActivityContext. Renewal is gated on it in getSession() and in updateSession(), which rewrites the key and so renews just as effectively as expire() — it now re-applies the remaining TTL instead of the full one when the caller is idle. An absent or malformed header still renews, so every client that does not send it keeps the behavior it has today.