Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=209.85.215.195; helo=mail-pg1-f195.google.com; envelope-from=peter@netlandish.com; receiver=<UNKNOWN> 
Date: Mon, 23 Nov 2020 17:26:48 -0800
From: Peter Sanchez <peter@netlandish.com>
To: Leonhard Kuboschek <leo@jacobs-alumni.de>
Cc: ~petersanchez/public-inbox@lists.code.netlandish.com
Subject: Re: [PATCH django-impersonate] add option for auto-expiring
 impersonate sesions, implements #45
Message-ID: <20201124012648.dagh3gncwpsnhhvv@thinkpad>
References: <5ae6838bdebd6fa362f7.1606156358@red>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="omz5s77l2pinzj7e"
Content-Disposition: inline
In-Reply-To: <5ae6838bdebd6fa362f7.1606156358@red>


--omz5s77l2pinzj7e
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline

On 11/23, Leonhard Kuboschek wrote:
>+from datetime import datetime, timedelta

I wonder if it's not better to use the `django.utils.timezone` module
here? Also use UTC aware timestamps.

>+                start_time = datetime.fromtimestamp(request.session['_impersonate_start'])
>+                if datetime.now() - start_time > timedelta(seconds=settings.MAX_DURATION):

Use `datetime.utcfromtimestamp()` and `timezone.now()` which returns a
UTC aware copy of datetime.now(). We'd have to also use
`timezone.make_aware()` on the `start_time` variable when subtracting.

`if timezone.now() - timezone.make_aware(start_time) > ...`

I could be overthinking it but I'm imagining a crazy bug where an app is
deployed across multiple time zones, and systems are not setup to use
UTC, and then we end up invalidating sessions prematurely.

What do you think?

>     if check_allow_for_user(request, new_user):
>         request.session['_impersonate'] = new_user.pk
>+        request.session['_impersonate_start'] = datetime.now().timestamp()

If we make the change, this obviously would also have to move to
`timezone.now()`

--omz5s77l2pinzj7e
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEkJViJRZ6KPWgtGGig4/80jEiNdEFAl+8YVUACgkQg4/80jEi
NdEMpRAAonfo1hB1qPZs9l2ZlfGAffWNzq3X95Lrftuxl48I1vPaMtoRoqyPNlUC
/2/5t6qBBW1Avg5NhkfHiOh8yQVKs3EWmcaeQTpI6w2n8TjbR+hUuWT1IuX5OiJB
iNnch9eB20E8lae7+fX3eArXylm/o0jw4zpVGQB8mdCvTxvqi6SMfQdNwD3ZPeLL
EhqYFGBrHHcrBAbylL/BnCras8rEXQfVwBXso1ws/R2+1onIANzNLp7mGwXE66Tw
dg8abo+Be4O6phzhB61Aoiw7i32n7Xv1o9NyaJI1ObIePj7ci3F1r5MuvDCkGYYC
VCuAyn5vRQ67IeAT9nZojhI4wAxxFAwFijeldIMTo+ifEdSu8G+aRcG0aBDmtr+T
vz1sZf8mXPJd+po4qk3XL0ED3h++xM9DjvVqADvaBSup2lNuz+Yr2EJSZgR/Wz9i
gjlapcdXsI/h90UofMKv2NxDOOimrlDgkGzpBEtDH2SI+EjIHGwTU4DGn6ypca5W
3euCkybM3PeKFJB9+gyTVUCZpqTwkDJANp03F2wmBXRh8xFs2EoNWPQQ+mGzUUNk
I3nfRz5vSv87LhYh91dpaGtGThNhQF1MEza4tZC6Nb4pznuSsHQnVt4E4ryrh+si
MK3lqB2v0g6vrHWEQj25+6noxqQo68N1O+xwCxJ2GAjmRe9Dy48=
=QcxD
-----END PGP SIGNATURE-----

--omz5s77l2pinzj7e--