Merge pull request #16 from ucdavis/fix/session-timeout

Fix/session timeout

web/Program.cs

@@ -6,6 +6,7 @@
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Caching.Memory;
 using Newtonsoft.Json;
@@ -65,6 +66,14 @@
         logger.Fatal("Failed to get secrets from AWS. Error: " + ex.InnerException);
     }
 
+    //Use forwarded for headers on test and prod
+    builder.Services.Configure<ForwardedHeadersOptions>(options =>
+    {
+        options.ForwardedHeaders =
+            ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
+        options.KnownProxies.Add(IPAddress.Parse("192.168.56.134")); //The F5's internal IP
+    });
+
     // Add services to the container.
     builder.Services.AddControllersWithViews().AddSessionStateTempDataProvider().AddNewtonsoftJson(options =>
         {
@@ -220,6 +229,7 @@
     // Configure the HTTP request pipeline.
     if (!app.Environment.IsDevelopment())
     {
+        app.UseForwardedHeaders();
         app.UseExceptionHandler("/Error"); // Error page for production
         app.UseHttpsRedirection(); // Force HTTPS
 

web/Views/Shared/Components/SessionTimeout/Default.cshtml

@@ -39,7 +39,7 @@
                     fetch(this.sessionRefreshUrl)
                         .then(r => r.status == "200" ? r.json() : r)
                         .then(r => {
-                            var nextCheck = 600
+                            var nextCheck = 300
                             //show timeout warning if the session will time out in 5 minutes or less
                             if (r.secondsUntilTimeout !== undefined && r.secondsUntilTimeout < 300) {
                                 this.showSessionTimeoutWarning = true