guardian/frontend — pull request #1794 by janua (2013-10-01 16:06:38+00:00)
Title: Facia tool security

This does the following:

- Remove common functionality out of Login classes in both admin and facia-tool (`authentication.scala`)
- Add common functionality into base `LoginController` trait
- Add extra parameters to the outgoing OpenID request in facia-tool to set a max age of 0, forcing the user to re-enter their password.
- Adds `AuthActionWithTimeout` which takes a timeout from the configuration and uses a key in the play session cookie to see when this user was last seen, invalidating if it has been too long
- Adds the lastseen key that is being used by `AuthActionWithTimeout` to the the play session cookie in `openIDCallback` in the `Login` controller, so that on login the key makes it into the cookie.
- Allows testing through using `Play.isTest`

The problem with cookies before was that they were static, and easily spoofed. With this mechanism, the cookie cannot be tampered with because it is signed with the secret. (Provided you are using the new timeout mechanism)

`AuthAction` does not care about the time that exists inside the cookie. If you log into facia-tool, going through `AuthActionWithTimeout`, and then hit endpoints an hour later (After the timeout) using `AuthAction`, there would be no problem. But if the request goes through `AuthActionWithTimeout` the session is erased.