implement sessions and also log in/out

session data is stored in sqlite, not using php sessions

1 files changed, 13 insertions, 2 deletions

diff --git a/config.ini b/config.ini
index f5a083c..633a88c 100644
--- a/config.ini
+++ b/config.ini
@@ -8,6 +8,13 @@ name = Pleasant SSO
 ;; primary domain where your login page will be
 primary-domain = auth.example.com
 
+;; all domains that need to be visited to set cookies appropriately
+;; note that for now, it's assumed that the domain one level higher than these
+;; is the "registrable domain" where the cookies are set to
+;; e.g. for 'auth.example.com', the cookie will get Domain=example.com
+cookie-domains[] = auth.example.com
+cookie-domains[] = auth.example.net
+
 ;; location where the source code of the version of the software running on your
 ;; server can be found. so if you make any significant changes to the source
 ;; code you'd better put them up online somewhere and change this accordingly!!
@@ -28,13 +35,17 @@ header-prefix = X-Login
 ;; ConfigFile -> look in this file, see below
 provider = ConfigFile
 
+;; how long (in seconds) until a session expires and you have to log in again
+;; 1 year = 31557600, 1 month = 2629800, 1 week = 604800, 1 day = 86400
+lifetime = 604800
+
 
 ;; this next section allows you to define users very simple here in the config
 ;; file, in case you don't want to use an external auth provider (set above)
 ;; but if you are using an external provider it's okay to remove all of this
 [users]
 
-;; <user>.password-hash -> allow password login for user
+;; password-hash -> allow password login for user
 ;; password hash should be generated by php function 'password_hash'
-winter.password-hash = "$2y$12$V3dwpbHF5fTx46g9xMflvODNGmr0apltiaDONUSE2skRrslgcRxSS"
+winter[password-hash] = "$2y$12$V3dwpbHF5fTx46g9xMflvODNGmr0apltiaDONUSE2skRrslgcRxSS"
 ;; more options to be added in future!