Fixing issue #381: Incorrect handling of expiration time

diff --git a/social_auth/models.py b/social_auth/models.py
index 7b7934e31e18ef073f46f3fbc8cbaf9f9f359fab..87ce08a30c527385eeab9d6bc6e52d12b3a57f03 100644 (file)
--- a/social_auth/models.py
+++ b/social_auth/models.py
@@ -1,8 +1,7 @@
 """Social auth models"""
-from datetime import timedelta
-
+from datetime import datetime
 from django.db import models
-
+from django.utils.timezone import utc
 from social_auth.fields import JSONField
 from social_auth.utils import setting
 
@@ -48,15 +47,15 @@ class UserSocialAuth(models.Model):
         else:
             return {}
 
-    def expiration_delta(self):
+    def expiration_datetime(self):
         """Return saved session expiration seconds if any. Is returned in
-        the form of a timedelta data type. None is returned if there's no
+        the form of timezone-aware datetime. None is returned if there's no
         value stored or it's malformed.
         """
         if self.extra_data:
             name = setting('SOCIAL_AUTH_EXPIRATION', 'expires')
             try:
-                return timedelta(seconds=int(self.extra_data.get(name)))
+                return datetime.utcfromtimestamp(self.extra_data.get(name)).replace(tzinfo=utc)
             except (ValueError, TypeError):
                 pass
         return None

diff --git a/social_auth/views.py b/social_auth/views.py
index b38a148fe487e217692f7c6f4eaa915bc5b8dbbd..8f4bc3cfc452b44885c6f84a39310e76e6ec20c2 100644 (file)
--- a/social_auth/views.py
+++ b/social_auth/views.py
@@ -117,9 +117,9 @@ def complete_process(request, backend, *args, **kwargs):
                 # Set session expiration date if present and not disabled by
                 # setting. Use last social-auth instance for current provider,
                 # users can associate several accounts with a same provider.
-                if social_user.expiration_delta():
+                if social_user.expiration_datetime():
                     try:
-                        request.session.set_expiry(social_user.expiration_delta())
+                        request.session.set_expiry(social_user.expiration_datetime())
                     except OverflowError:
                         # Handle django time zone overflow, set default expiry.
                         request.session.set_expiry(None)