Session Timeout Documentation Missing NIST SP 800-63B Deviation Justification and Internal Inconsistency

[andrewmusselman]

Bringing this to asfquart out of some triage on tooling-trusted-releases; the question is upstream so we consolidate discussion about whether to adopt this or another standard, or document our decisions.

Specifically, things like what should all our timeouts be, how does this line up with MFA, if a user logs out of an app does it invalidate their MFA, etc.

Summary

Two documentation deficiencies exist in the session timeout configuration: (1) the NIST SP 800-63B deviation justification is absent, and (2) the hardcoded 7-day inactivity timeout can never fire under the default 72-hour absolute maximum, making it effectively dead code.

Details

Both an inactivity timeout (_SESSION_IDLE_TIMEOUT, 7 days) and an absolute maximum lifetime (MAX_SESSION_AGE, documented default 72 hours) exist and are documented. However:

1. The documentation describes the timeout values but does not reference NIST SP 800-63B re-authentication requirements or justify the chosen values as a deviation.
2. The 7-day inactivity timeout is longer than the 72-hour absolute maximum, so the inactivity check can never fire under default configuration — making it effectively dead code.

Attacker capability required: None (documentation/analysis gap).
Impact: No direct C/I/A impact.

Affected files:

• atr/sessions.py
• atr/docs/authentication-security.md
• atr/docs/asfquart-usage.md

ASVS: 7.1.1 (L2)

Remediation

Add a session risk-analysis note to the session-management documentation that:

• (a) States the concrete inactivity and absolute-lifetime values actually enforced by Store.validate().
• (b) Documents the relationship between the hardcoded 7-day idle timeout and the configurable absolute maximum.
• (c) Records the justification for deviating from NIST SP 800-63B re-authentication intervals given the delegation of primary auth to the ASF IdP.

Consider making _SESSION_IDLE_TIMEOUT configurable so it cannot silently become dead code.

Acceptance Criteria

• Fixed
• Test added — assert that Store.validate() correctly applies both timeout values and that the inactivity timeout is reachable under a configuration where it is shorter than the absolute maximum

References

• ASVS 7.1.1
• Source report: 7.1.1.md