VIA-942: Enforce Session Expiry Reliably After 10 Minutes of Inactivity by liming-cheung-nhs · Pull Request #708 · NHSDigital/vaccinations-app

liming-cheung-nhs · 2026-04-27T15:10:49Z

Description

Created cookie on logout so when session refresher comes (every 60s), it would see this and not try to refresh.
This ensures logout action is honoured.
The cookie created holds the session id - this ensures it does not interfere with user having logged in again as it would be under different session id.
updated cookie text based on design spec

Testing on deployed to sandpit personal workspace

logged out -> waited 10 mins -> remains logged out (test QA highlighted in ticket)
logged in -> wait auto timeout 10 mins -> ignore dialogue box -> wait -> logs out as expected
seen new cookie in browser

30/04/2026
I was getting this Client side error- UNHANDLED_PROMISE_REJECT_ERROR on logout when put signout and cookie set in server. signout needs to be in client given current UI implementation - see comment in code. The error went away when moved signout from server.

Note: Existing issue under investigation: getToken will return null, but the MyVaccines app then currently tries to redirect the user to NHS App because they are not authenticated, meaning the user will never see the logout / session timeout screens. (at present this throws a cors error in the browser and the user never actually gets to NHS app but this is a quirk and the underlying issue still needs fixing; the user shouldnt be redirected at all for this part of the journey. The network tab shows the cors error and an error would be logged in our service logs).

Context

Type of changes

Refactoring (non-breaking change)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would change existing functionality)
Bug fix (non-breaking change which fixes an issue)

Checklist

I am familiar with the contributing guidelines
I have followed the code style of the project
I have added tests to cover my changes
I have updated the documentation accordingly
This PR is a result of pair or mob programming

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

… recently called Precommit hooks bypassed; this is a work in progress commit WIP commit: contains * A Server Action to set the flag cookie * Calling the server action from the user-logout method * cherck the flag in getToken Issue under investigation 1. getToken will return null, but the MyVaccines app then currently tries to redirect the user to NHS App because they are not authenticated, meaning the user will never see the logout / session timeout screens. (at present this throws a cors error in the browser and the user never actually gets to NHS app but this is a quirk and the underlying issue still needs fixing; the user shouldnt be redirected at all for this part of the journey. The network tab shows the cors error and an error would be logged in our service logs).

Co-authored-by: Copilot <copilot@github.com>

Copilot

Pull request overview

Implements a short-lived “signout flag” cookie to prevent session refresh logic from re-authenticating a user immediately after logout/inactivity timeout, improving enforcement of 10-minute inactivity expiry.

Changes:

Add __Secure-signout cookie constant and document it in the cookies policy table.
Set the signout-flag cookie during logout and check it in the NextAuth jwt/getToken callback to return null for recently-signed-out sessions.
Add/extend unit tests for the new logout flow, cookie setting, and token callback behavior.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/utils/constants.ts	Adds constant for the new signout-flag cookie name.
src/utils/auth/user-logout.ts	Converts logout to a server action, wraps in request-scoped storage, and sets signout-flag cookie before signing out.
src/utils/auth/user-logout.test.ts	Updates mocks and adds assertions for flag cookie + request-scoped wrapper usage.
src/utils/auth/setSignOutFlagCookie.ts	New server action to set a short-lived signout-flag cookie tied to the session id.
src/utils/auth/setSignOutFlagCookie.test.ts	New unit test validating the signout cookie is set as expected.
src/utils/auth/callbacks/get-token.ts	Reads signout-flag + session-id cookies to short-circuit and return `null` after recent signout.
src/utils/auth/callbacks/get-token.test.ts	Adds tests ensuring `getToken` returns `null` when signout flag matches current session.
src/app/our-policies/cookies-policy/CookiesTable.tsx	Documents the new `__Secure-signout` cookie and its purpose/expiry.
src/app/our-policies/cookies-policy/CookiesTable.test.tsx	Updates expectations to include the new cookie row and timing.
src/app/_components/inactivity/InactivityDialog.test.tsx	Adjusts mocking for updated logout module usage.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <copilot@github.com>

liming-cheung-nhs · 2026-04-30T22:21:51Z

+
+const log = logger.child({ module: "utils-auth-setSignOutFlagCookie" });
+
+const setSignOutFlagCookie = async () => {


I had to split the logout flow back again because the two steps need different runtimes.

The signout cookie must be set on the server so it can use request cookies and requestScopedStorageWrapper.

The actual signOut() stays on the client because when both steps were moved to the server, the logout response no longer preserved the signout cookie reliably, so the logout flow stopped working properly. Keeping signOut() on the client preserves the cookie step and still gives the expected immediate logout and redirect.

Co-authored-by: Copilot <copilot@github.com>

kieran-broomhall-nhs · 2026-05-01T14:36:56Z

        maxAgeInSeconds,
      );
    });
+


Is this not a duplicate tests as what is added above?

kieran-broomhall-nhs · 2026-05-01T14:39:39Z

+  };
+
+  it("should set signout cookie with the current session id", async () => {
+    mockGetCookie = (name: string) => {


Is this duplicated mocking needed as its the same as above?

donna-belsey-nhs and others added 2 commits April 23, 2026 11:29

set signout cookie flag to session id

296e908

liming-cheung-nhs requested a review from a team as a code owner April 27, 2026 15:10

liming-cheung-nhs temporarily deployed to dev April 27, 2026 15:15 — with GitHub Actions Inactive

add info on new cookie for user

de5a981

liming-cheung-nhs commented Apr 27, 2026

View reviewed changes

Comment thread src/utils/auth/setSignOutFlagCookie.test.ts Outdated

liming-cheung-nhs temporarily deployed to dev April 27, 2026 15:53 — with GitHub Actions Inactive

liming-cheung-nhs commented Apr 27, 2026

View reviewed changes

Comment thread src/utils/auth/setSignOutFlagCookie.ts

add cookie table test

1f86212

Co-authored-by: Copilot <copilot@github.com>

liming-cheung-nhs temporarily deployed to dev April 27, 2026 17:38 — with GitHub Actions Inactive

update cookie info to reflect final design

b8a2c56

liming-cheung-nhs temporarily deployed to dev April 28, 2026 09:45 — with GitHub Actions Inactive

terence-sheppard-nhs reviewed Apr 28, 2026

View reviewed changes

Comment thread src/utils/auth/callbacks/get-token.test.ts Outdated

Comment thread src/utils/auth/setSignOutFlagCookie.test.ts Outdated

Comment thread src/utils/auth/user-logout.ts

Comment thread src/app/_components/inactivity/InactivityDialog.test.tsx Outdated

liming-cheung-nhs and others added 4 commits April 28, 2026 17:30

update cookie info to reflect final design 2

209c48c

replace sanitize-data with missing dependency mocks

2f54fb7

tidy up tests

2523676

Co-authored-by: Copilot <copilot@github.com>

wrap userLogout action - logout and set cookie - in request context

acce62c

Co-authored-by: Copilot <copilot@github.com>

liming-cheung-nhs temporarily deployed to dev April 28, 2026 17:59 — with GitHub Actions Inactive

liming-cheung-nhs requested a review from terence-sheppard-nhs April 28, 2026 19:00

terence-sheppard-nhs previously approved these changes Apr 29, 2026

View reviewed changes

terence-sheppard-nhs requested a review from Copilot April 29, 2026 11:47

Copilot started reviewing on behalf of terence-sheppard-nhs April 29, 2026 11:48 View session

Copilot AI reviewed Apr 29, 2026

View reviewed changes

copilot comments

bd12691

Co-authored-by: Copilot <copilot@github.com>

liming-cheung-nhs dismissed terence-sheppard-nhs’s stale review via bd12691 April 30, 2026 14:16

liming-cheung-nhs requested a review from terence-sheppard-nhs April 30, 2026 14:17

liming-cheung-nhs temporarily deployed to dev April 30, 2026 14:22 — with GitHub Actions Inactive

sophie-poole-nhs previously approved these changes Apr 30, 2026

View reviewed changes

terence-sheppard-nhs previously approved these changes Apr 30, 2026

View reviewed changes

liming-cheung-nhs dismissed terence-sheppard-nhs’s stale review via 413fe4b April 30, 2026 17:28

liming-cheung-nhs dismissed sophie-poole-nhs’s stale review via 413fe4b April 30, 2026 17:28

liming-cheung-nhs commented Apr 30, 2026

View reviewed changes

Comment thread src/app/_components/nhs-frontend/AppHeader.tsx Outdated

liming-cheung-nhs commented Apr 30, 2026

View reviewed changes

Comment thread src/app/_components/inactivity/InactivityDialog.tsx Outdated

liming-cheung-nhs commented Apr 30, 2026

View reviewed changes

move signout back to client side to match the UI handling as is

ddf571b

Co-authored-by: Copilot <copilot@github.com>

liming-cheung-nhs force-pushed the VIA-942/set-signout-cookie branch from 413fe4b to ddf571b Compare April 30, 2026 22:51

liming-cheung-nhs temporarily deployed to dev April 30, 2026 22:55 — with GitHub Actions Inactive

kieran-broomhall-nhs reviewed May 1, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

VIA-942: Enforce Session Expiry Reliably After 10 Minutes of Inactivity#708

VIA-942: Enforce Session Expiry Reliably After 10 Minutes of Inactivity#708
liming-cheung-nhs wants to merge 11 commits intomainfrom
VIA-942/set-signout-cookie

liming-cheung-nhs commented Apr 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

liming-cheung-nhs Apr 30, 2026

Uh oh!

kieran-broomhall-nhs May 1, 2026

Uh oh!

kieran-broomhall-nhs May 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants


		const log = logger.child({ module: "utils-auth-setSignOutFlagCookie" });

		const setSignOutFlagCookie = async () => {

Conversation

liming-cheung-nhs commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing on deployed to sandpit personal workspace

Context

Type of changes

Checklist

Sensitive Information Declaration

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

liming-cheung-nhs Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

kieran-broomhall-nhs May 1, 2026

Choose a reason for hiding this comment

Uh oh!

kieran-broomhall-nhs May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

liming-cheung-nhs commented Apr 27, 2026 •

edited

Loading