alphagov/gds-sso — pull request #6 by alext (2012-07-26 16:17:04+00:00)
Title: Expire sessions 20 hours after login.

Timeout can be configured by setting auth_valid_for in the GDS::SSO
config.

We're not doing this with the Rails session expire_after method for the
following reasons:

* That would expire the whole session (including any preferences), not
just the authentication.
* It would only be an idle timeout, not time since login.
* It would only be enforced client-side, and trivial to bypass.