nx_session_ttl.nx
buildroot/runtime/nx_session_ttl.nx
about
nx_session_ttl.nx -- SESSION IDLE + ABSOLUTE TIMEOUT (closes hosting_research gap #8 "session-rotate-
timeout", 2/0 CONFIRMED). nx_cms_admin issues a constant-time 32-byte session token (HttpOnly+SameSite=
Strict+Secure, 5-strike lockout) but checks ONLY token-match with NO timestamp -> a captured cookie is
valid until the daemon restarts. OWASP ASVS V3 requires BOTH an idle timeout (re-auth after inactivity)
and an absolute timeout (hard cap on session age), plus token rotation on login. This is the sovereign,
DETERMINISTIC (caller-supplies `now`, so a session lifecycle is replayable) timeout primitive the daemon
composes. Session record layout (caller-owned, reuses the existing 64-byte sess buffer):
[0..32) token [32..40) issued_at_ms (i64) [40..48) last_seen_ms (i64)
module: nishi-core.auth.session_ttl capability: ACCESS_CONTROL / auth
dependencies 1 imports · 3 importers
imports: nx_syscalls.nx
imported by: nx_cms_admin.nxnx_cms_session_gate.nxnx_session_ttl_gate.nx
structs
| none |
consts
| 13 | const SESS_VALID: i64 = 0 |
| 14 | const SESS_EXPIRED_IDLE: i64 = 1 // inactive too long -> re-auth |
| 15 | const SESS_EXPIRED_ABS: i64 = 2 // older than the hard cap -> re-auth even if active |
| 16 | const SESS_IDLE_TTL_MS: i64 = 1800000 // 30 min inactivity (OWASP: 15-30 min for sensitive apps) |
| 17 | const SESS_ABS_TTL_MS: i64 = 43200000 // 12 h hard cap regardless of activity |
functions
| 21 | func sess_check(issued_at: i64, last_seen: i64, now: i64, idle_ttl: i64, abs_ttl: i64) -> i64 |
| 28 | func sess_issued(rec: *u8) -> i64 { let p: *i64 = (rec + 32) as *i64; return p[0] } |
| 29 | func sess_lastseen(rec: *u8) -> i64 { let p: *i64 = (rec + 40) as *i64; return p[0] } |
| 32 | func sess_issue(rec: *u8, now: i64) -> i64 |
| 38 | func sess_touch(rec: *u8, now: i64) -> i64 { let pl: *i64 = (rec + 40) as *i64; pl[0] = now; return 0 } |
| 40 | func sess_verify(rec: *u8, now: i64) -> i64 |