Repository: freedomofpress/securedrop

Issue:
Increase default session timeouts to 120 minutes
## Description

According to [this plot](https://metrics.torproject.org/torperf.html?start=2017-08-03&end=2017-11-01&source=all&server=onion&filesize=5mb), it currently takes about ~35 seconds to download a 5 MB file over Tor: 

![torperf-onion-2017-08-03-2017-11-01-all-5mb](https://user-images.githubusercontent.com/7832803/32303423-c305bdd8-bf25-11e7-9ac9-fffd8a95fbbd.png)

The maximum size of a SecureDrop submission is 500 MB, so the time it would take to download is 35 seconds * (500/5) = 3500 seconds, or just under an hour. As such, to be safe we should bump the session timeout to at least 120 minutes. 

## User Stories

As a SecureDrop source/journalist, I don't want to wait a very long time to upload/download a file over Tor, only to be logged out by the SecureDrop session timeout. 


Discussion:
Have we tested the behavior on this? What happens when someone exceeds the timeout while a download is in progress? Does it drop the connection?

Either way, we could bump the session duration *only for that request* so that the first page load after will be ok, and then it will be reset to the normal 30 minutes during the next request (namely, the request that loads the HTML/does the redirect). This would keep the window of compromise as tight as possible while allowing for long downloads.
When I tested this behavior it logged the user out - _after_ the very long upload - _and_ the submission doesn't go through. 

> Either way, we could bump the session duration only for that request so that the first page load after will be ok, and then it will be reset to the normal 30 minutes during the next request (namely, the request that loads the HTML/does the redirect). This would keep the window of compromise as tight as possible while allowing for long downloads.

I hear ya - the thing is I don't think the marginal security benefit of a shorter session timeout  justifies the additional complication of modifying the session timeout for only certain requests. I suggest we keep it simple for maintainability and increase the session timeout for now. 

Resolving patch:
diff --git a/securedrop/journalist_app/__init__.py b/securedrop/journalist_app/__init__.py
--- a/securedrop/journalist_app/__init__.py
+++ b/securedrop/journalist_app/__init__.py
@@ -67,7 +67,7 @@ def setup_g():
         session['expires'] = datetime.utcnow() + \
             timedelta(minutes=getattr(config,
                                       'SESSION_EXPIRATION_MINUTES',
-                                      30))
+                                      120))
 
         uid = session.get('uid', None)
         if uid:
diff --git a/securedrop/source_app/__init__.py b/securedrop/source_app/__init__.py
--- a/securedrop/source_app/__init__.py
+++ b/securedrop/source_app/__init__.py
@@ -97,7 +97,7 @@ def setup_g():
         session['expires'] = datetime.utcnow() + \
             timedelta(minutes=getattr(config,
                                       'SESSION_EXPIRATION_MINUTES',
-                                      30))
+                                      120))
 
         # ignore_static here because `crypto_util.hash_codename` is scrypt
         # (very time consuming), and we don't need to waste time running if


Test patch: