feat: add AUTH_SESSION_TIMEOUT environment variable for configurable session duration

[skynetigor]

Closes #5028

📑 Description

✅ Checks

• My pull request adheres to the code style of this project
• My code requires changes to the documentation
• I have updated the documentation as required
• All the tests have passed

ℹ Additional Information

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
keep	⬜️ Ignored (Inspect)	Visit Preview		Jun 16, 2025 5:37pm

[cursor-com]

Bug: Invalid Session Timeout Causes Authentication Issues

The AUTH_SESSION_TIMEOUT environment variable is parsed using Number.parseInt() without validation. If AUTH_SESSION_TIMEOUT contains a non-numeric value (e.g., "abc" or an empty string), Number.parseInt() returns NaN. This NaN is then assigned to NextAuth.js's session.maxAge, which can lead to broken session management or undefined behavior. The parsed value should be validated or a more robust parsing method with a fallback to the default should be used.

keep-ui/auth.config.ts#L23-L26

keep/keep-ui/auth.config.ts

Lines 23 to 26 in ae4064e

	const authSessionTimeout = process.env.AUTH_SESSION_TIMEOUT
	? Number.parseInt(process.env.AUTH_SESSION_TIMEOUT)
	: 30 * 24 * 60 * 60; // Default to 30 days if not set

Fix in Cursor

---

Was this report helpful? Give feedback by reacting with 👍 or 👎