Session timeout not enforced server-side (replayable old sessions)

#135

Closed glennmichael123 opened this 9 days ago ·

glennmichael123 9 days ago

Severity: Medium · Where: collect.ts (no startedAt/age check); client-only timeout at tracking-script.ts:287-301 No server-side session age/inactivity check, so a client can replay arbitrarily old session IDs. Impact: Inflated avg session duration. Fix: Enforce a max session age / inactivity window at ingest.