Question

In my web app, I require users to re-enter their password after five minutes of inactivity, similar to how sudo works on Linux. Their password is used to decrypt information.

FWIW, the app is heavily Javascript and AJAX-driven, just like a desktop app, using ExtJS.

So, I’ve built a class which provides access to a decryption key based on the password they enter. This class expires the key after five minutes.

My question is: what design pattern does this follow or what would be a better name than ‘Sentry’? I’m trying to name my class appropriately. Here’s the class thus far:

class SecureResourceSentry
  include Singleton

  def initialize
    # Set a default number of seconds for access to expire.
    set_access_expiration_interval(300)

    @key = nil
    @time_last_accessed = 0
  end

  def set_access_expiration_interval(seconds)
    @access_expiration_interval = seconds
  end

  def set_raw_key(raw_key)
    @key = Digest::SHA256.hexdigest(raw_key)
  end

  def getKey
    if @key.nil?
      raise SecureResourceError, 'No key has been set.'
    end

    if access_is_expired
      @key = nil
      raise SecureResourceError, 'Access has expired.'
    end

    return @key
  end

  private
    def access_is_expired
      return Time.now.to_i - @time_last_accessed > @access_expiration_interval
    end
end

Answer 1

It looks similar to the revocable accessor described in this secure design patterns talk : “The Lazy Programmer’s Guide to Secure Computing”

Maybe call it an expiring accessor.