Description

This PR is intended to allow the platform to control the user session expiration time by introducing a new setting. The need for this support comes from the fact that a session timeout is a security mechanism whereby a connection to an application or service
is forcibly disconnected after a specified period of inactivity. This is intended to prevent an
unattended or forgotten management session from being used by an unauthorised or
malicious user. Any valid, current session that is discovered presents the risk of accidental or
malicious configuration changes being made within the context of the hijacked session’s
privilege level.

Changes.

• Add new SESSION_EXPIRY_SECONDS setting to set the user session expiration time.

How to test?

In devstack:

1. Get the devstack up and running
2. Get in the lms shell make lms-shell
3. Add the SESSION_EXPIRY_SECONDS variable to /edx/etc/lms.yml
4. Check if setting was taken into account, open a djago shell /edx/bin/edxapp-shell-lms and execute:

from django.conf import settings
settings.SESSION_EXPIRY_SECONDS

5. Remove cookies in case you previously had a session and log in again an check the lms_sessionid cookie and validate if its expiration matches with the new setting.