commit 3847f58ec94bfc1f8f93b51b1de8575b621140ab
author Joe Downing <joedow@google.com> Mon Jul 28 22:55:15 2025
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Jul 28 22:55:15 2025
tree 2819546b7c264eea1d7f6bbbc1a9713758e8fb5b
parent 22d9b010ae92b05ed70366a8792056fddbaed26d

Modify reauth interval calculation to handle larger expiration values

The original reauth token lifetime was hard-coded to 10 minutes. I've
modified the Cloud SessionAuthz logic to allow the admin to define the
period such that they can decide on the trade-off between session
disconnection response time and resource usage for the queries needed
to determine whether the session is authorized.

If the admin chooses a value like '24 hours' then the current logic
will begin retrying at the 12 hour mark. If there is an error, then
the retries will continue over that 12 hour period.  I think we
should tighten this up and enforce a minimum reauth interval of 2.5
minutes and a maximum of ~10 minutes. This will potentially reduce
load on our services (if Cloud hosts are used with large'ish reauth
expirations) and keep the behavior more inline with the expectation of
the admin wrt resource usage when enabling the feature.

Change-Id: I8a83307962a65727ed82eeefdcf414a56bfc5cde
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6785639
Auto-Submit: Joe Downing <joedow@chromium.org>
Reviewed-by: Yuwei Huang <yuweih@chromium.org>
Commit-Queue: Joe Downing <joedow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1493159}