Labels: bug, cleanup · Severity: Low
Location:
src/webserver/src/WebServer.h:59 — #define SESSION_TIMEOUT_SECS 300 // 5 minutes session expirationsrc/webserver/src/WebServer.cpp:1830-1831 — if ( (curr_time - session->m_last_access) > 7200 )
Description: A SESSION_TIMEOUT_SECS constant is defined (and documented as 5 minutes)
but never used. The actual expiry is a hardcoded 7200 (2 hours). The define is dead code
and the documented behavior is wrong; the longer-than-advertised window also slightly widens
the session-hijacking surface (relates to SEC-2).
Impact: Misleading code/docs; unintended 2-hour session lifetime.
Suggested fix: Decide on the intended timeout, replace the magic 7200 with the named
constant, and fix/remove the comment. Remove the define if it stays unused.
Labels:
bug,cleanup· Severity: LowLocation:
src/webserver/src/WebServer.h:59—#define SESSION_TIMEOUT_SECS 300 // 5 minutes session expirationsrc/webserver/src/WebServer.cpp:1830-1831—if ( (curr_time - session->m_last_access) > 7200 )Description: A
SESSION_TIMEOUT_SECSconstant is defined (and documented as 5 minutes)but never used. The actual expiry is a hardcoded
7200(2 hours). The define is dead codeand the documented behavior is wrong; the longer-than-advertised window also slightly widens
the session-hijacking surface (relates to SEC-2).
Impact: Misleading code/docs; unintended 2-hour session lifetime.
Suggested fix: Decide on the intended timeout, replace the magic
7200with the namedconstant, and fix/remove the comment. Remove the define if it stays unused.