rapidftr/RapidFTR — pull request #637 by rdsubhas (2014-06-12 15:42:39+00:00)
Title: rapidftr/tracker#31 Handle session expiration on server

Instead of relying on cookie expiration (which is relative to client time), Handle the session timeouts in the server side (relative to server time). So the expiration is counted as 20 minutes *from the server time* you last accessed RapidFTR.

This is done by storing `last_access_time` on the cookie. This is safe, because we are using [encrypted cookies](https://github.com/hmcfletch/encrypted-cookie-store) and nobody will be able to tamper the cookies. The password for the encrypted cookie is randomly generated on the server and saved in CouchDB, so people cannot guess the password by looking at the source code as well.

Steps to verify:
* Wait until this pull request is merged and deployed to [[https://dev.rapidftr.com]]
* We used Chrome with the "EditThisCookie" extension which allows to see cookies
* Login to dev.rapidftr.com
* Check the cookies. You'll find a cookie called `_session`
* This is encrypted. It tracks your session ID and the last time you accessed the server. You won't be able to see or edit anything in this cookie
* Change your system time and refresh. But you won't be logged out. The server tracks 20 minutes relative to the server time. You don't need to keep the time on your browser/mobile in sync with the server anymore
* Wait for 20 minutes (don't do anything, or your session will be extended by 20 mins again). Refresh and the session will be logged out