lato 3.24.0 → 3.26.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '09a445f7a4001cf512ef060934adeea3a0fd7620ebc7a8334bb95ea3e637939f'
-  data.tar.gz: aac7020d5b8ae8698a46249870543cb25cb193b2e1d910f856381fd5d1945f72
+  metadata.gz: 4fbacf743cd38a4c4b42cc018a23fa40107f40d08d076ca05a5cd2ac539f84f2
+  data.tar.gz: 54c1b642c8aa9b42136b773067207b36cb2760b4695e5b8ecb073e8f798e830d
 SHA512:
-  metadata.gz: eeaccec11e915e024139107529d49d3878b341de85ecebb9551ce7367cbacc591362d93da08f6760eb5372eb844277e0d31c835923a20b82d240d926b4e599ba
-  data.tar.gz: a4864739c065fe216835e04b509620c7748fff88a51e8dc57849f9f7515518f0fdb3ab5e9b69f30adefb2680a48e9a149b630674f31dfeae442b919c13997a5f
+  metadata.gz: f1605ffef039889624f834a870709c910dbb614a78868cf4c0a84d0925dc7f7c72f8b1db8a6c0527ea422c327dec75c58b27a342a32e9ae49d5b4ceedcbf0210
+  data.tar.gz: 52fc4da5a54c9d35f2dd4fd324f20e750496d1bf7bf8b787129795b66d565c68742b1ec2803e87bf1c055a54760a216b72e60d78af61a256b6c18fc3c50042a7

data/README.md

@@ -5,7 +5,7 @@
 Lato is a Rails Engine that offers a comprehensive web application starter kit with user management, authentication, and UI components for [Ruby on Rails](https://rubyonrails.org/).
 
 This gem includes:
-- User management with **full authentication system** (signin, signup, recover password, email validation, Google Authenticator multi-factor authentication, ETH wallet connection) and **account management** (user settings, password change, email change, etc.);
+- User management with **full authentication system** (signin, signup, recover password, email validation, Google Authenticator and WebAuthn/passkey multi-factor authentication, ETH wallet connection) and **account management** (user settings, password change, email change, etc.);
 - **Web interface** built with [Bootstrap](https://getbootstrap.com/) and [Bootstrap Icons](https://icons.getbootstrap.com/);
 - **UI components integrated with Rails** (data tables, forms, modals, async job executions etc.);
 
@@ -13,7 +13,7 @@ The gem is **agnostic to the application stack**. You can use it with different
 
 The gem is designed to be easily **customizable and extendable**. You can fully customize the UI and the functionalities of the panel. You can also add new functionalities and components to the panel on the main application or develop new engines to extend the panel.
 
-The gem is ready to be used with the **latest Rails 7+** features like **[ESM import maps](https://github.com/rails/importmap-rails)**, **[Turbo](https://turbo.hotwired.dev/)** and **[Stimulus](https://stimulus.hotwired.dev)**. The front-end is designed to be responsive, mobile friendly and accessible.
+The gem is ready to be used with the **Rails 8.1.3.1 or later within the 8.1 series** features like **[ESM import maps](https://github.com/rails/importmap-rails)**, **[Turbo](https://turbo.hotwired.dev/)** and **[Stimulus](https://stimulus.hotwired.dev)**. The front-end is designed to be responsive and mobile friendly, with accessibility improvements in progress (see the component notes in the documentation).
 
 <img src="./preview.gif" alt="Lato preview" width="100%">
 
@@ -41,13 +41,13 @@ Add required dependencies to your application's Gemfile:
 
 ```ruby
 # Use JavaScript with ESM import maps [https://github.com/rails/importmap-rails]
-gem "importmap-rails" # NOTE: Probably already installed in default rails 7+ project
+gem "importmap-rails" # NOTE: Probably already installed in default Rails 8 project
 
 # Hotwire's SPA-like page accelerator [https://turbo.hotwired.dev]
-gem "turbo-rails" # NOTE: Probably already installed in default rails 7+ project
+gem "turbo-rails" # NOTE: Probably already installed in default Rails 8 project
 
 # Hotwire's modest JavaScript framework [https://stimulus.hotwired.dev]
-gem "stimulus-rails" # NOTE: Probably already installed in default rails 7+ project
+gem "stimulus-rails" # NOTE: Probably already installed in default Rails 8 project
 
 # Use Sass to process CSS
 gem "sassc-rails"
@@ -75,6 +75,10 @@ rails lato:install:migrations
 rails db:migrate
 ```
 
+Lato stores rate limits, password recovery codes, email verification codes and semaphores in `Rails.cache`. Use a persistent cache shared across processes (Redis, Solid Cache, Memcached): with `:null_store` password recovery never works and rate limits are disabled, with `:memory_store` and multiple processes limits are per process.
+
+To use the Web3 (ETH wallet) authentication add `gem "eth"` to your Gemfile, it is not a dependency of Lato.
+
 Mount lato routes on the **config/routes.rb** file:
 
 ```ruby
@@ -113,6 +117,8 @@ end
 
 ```
 
+Lato ships translations for `it`, `en`, `fr` and `ro`. Any key can be overridden in your application locale files. Emails exist only in Italian and English: users with locale `it` receive Italian emails, every other locale receives English.
+
 ### Extra tasks
 Lato integrates by default a basic PWAs manifest and service worker. To re-generate them with all required assets follow these steps:
 
@@ -136,6 +142,44 @@ rails lato:install:migrations
 rails db:migrate
 ```
 
+### Upgrading to the latest release
+
+- Run `rails lato:install:migrations && rails db:migrate`: the release adds `authenticator_last_used_at` and `webauthn_sign_count` to `lato_users`.
+- `lato_page_head(title)` now escapes the title. Pass an `html_safe` string to render HTML.
+- `lato_form_item_input_check` escapes the label unless it is `html_safe`.
+- `data-turbo-confirm` messages and `data-action-title` are rendered as plain text.
+- New config `Lato.config.auth_password_min_length` (default 8), checked whenever a password is set.
+- Rate limits are stricter: `limit_requests` allows exactly `limit` requests per IP and action, signin is also limited per email (10 failed attempts in 15 minutes) and second factor attempts are counted per user. The pending second factor step expires after 10 minutes or 5 wrong codes.
+- TOTP codes can be used only once and the WebAuthn signature counter is enforced.
+- Web3 signin uses a message bound to host, nonce and issue time (single use, 5 minutes) and requires `gem "eth"`.
+- `switch_locale` redirects only to same-host referers. The GET route `switch_locale_get` is deprecated: use POST `lato.switch_locale_path(locale:)`.
+- `Lato::Operation#start` only starts classes inheriting from `Lato::ApplicationJob`.
+- Schedule the maintenance jobs `Lato::LatoOperationsCleanerJob` and `Lato::ActiveStorageCleanerJob` (see the operations documentation).
+
+### Upgrading to 3.25
+
+Lato 3.25 requires Rails >= 8.1.3.1 and < 8.2. Install the new session migration before serving requests (`rails lato:install:migrations && rails db:migrate`).
+
+Sessions are stored as revocable token hashes in the database. Existing cookies require a fresh sign-in after upgrading (global logout). Signing out revokes the current device; changing or recovering a password revokes all devices. Password recovery preserves existing second factors and does not disable them.
+
+Account password, email, authentication factor, wallet, and account deletion changes require the current password plus an enrolled authenticator or security key. Authenticator enrollment requires confirmation with a valid code; an active authenticator's secret is never displayed again. API clients submit `user[current_password]` and, when enrolled, `user[current_authenticator_code]`. Security key clients first POST to `account/security_challenge`, then submit the assertion as `user[current_webauthn_credential]`. Enrollment continuations expire after five minutes and can only be used once.
+
+Extensions updating session attributes must call `session_update(extra_params)` to preserve the revocable session and secure cookie attributes.
+
+## Production security checklist
+
+- Set `config.force_ssl = true`: the session cookie is `secure` only when the request is SSL.
+- Use a persistent `Rails.cache` shared across processes (Redis, Solid Cache, Memcached). Recovery codes, verification codes and all rate limits depend on it; Lato logs a warning at boot in production if it is a `NullStore`.
+- Set `config.action_controller.raise_on_open_redirects = true`.
+- Content Security Policy: the Web3 and verify-email views use inline scripts, so those pages need `unsafe-inline` or nonces. `ethers` 5.7.2 is loaded from cdnjs with a dynamic `import()`: pinned to an exact version but without SRI. Vendor it if you need strict supply-chain control.
+- `session_lifetime` (default 30 days) is an absolute lifetime of cookie and database record, with no sliding renewal or idle timeout.
+- WebAuthn: use HTTPS in `webauthn_origin` (a string or an array of origins). There is one credential per user, no backup codes, and user verification is not required.
+- hCaptcha is optional (`hcaptcha_site_key`, `hcaptcha_secret`) and protects signup and password recovery.
+- Schedule `Lato::LatoOperationsCleanerJob` and `Lato::ActiveStorageCleanerJob`, they are not scheduled automatically.
+- Invitations do not expire: destroy pending ones that are no longer needed.
+- `authenticator_secret` is stored in clear in the database: consider Active Record encryption.
+- Signin per-email limiting can be used to temporarily lock a known email: monitor failed signins.
+
 ## Development
 
 Clone repository, install dependencies, run migrations and start:

data/app/assets/javascripts/lato/controllers/lato_account_security_controller.js

@@ -0,0 +1,51 @@
+import { Controller } from '@hotwired/stimulus'
+
+export default class extends Controller {
+  static targets = ['credential', 'error']
+  static values = { challengeUrl: String, webauthn: Boolean }
+
+  connect () {
+    this.form = this.element.closest('form')
+    this.onSubmit = this.confirm.bind(this)
+    this.form.addEventListener('submit', this.onSubmit)
+  }
+
+  disconnect () {
+    this.form.removeEventListener('submit', this.onSubmit)
+  }
+
+  async confirm (event) {
+    if (!this.webauthnValue || this.confirmed) return
+    event.preventDefault()
+    event.stopImmediatePropagation()
+    this.errorTarget.textContent = ''
+    try {
+      const response = await fetch(this.challengeUrlValue, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]').content }
+      })
+      if (!response.ok) throw new Error('Unable to request security key confirmation.')
+      const publicKey = await response.json()
+      const decode = value => Uint8Array.from(atob(value.replace(/-/g, '+').replace(/_/g, '/')), c => c.charCodeAt(0))
+      publicKey.challenge = decode(publicKey.challenge)
+      publicKey.allowCredentials = publicKey.allowCredentials.map(credential => ({ ...credential, id: decode(credential.id) }))
+      const credential = await navigator.credentials.get({ publicKey })
+      const encode = buffer => btoa(String.fromCharCode(...new Uint8Array(buffer)))
+      this.credentialTarget.value = JSON.stringify({
+        id: credential.id,
+        rawId: encode(credential.rawId),
+        type: credential.type,
+        response: {
+          clientDataJSON: encode(credential.response.clientDataJSON),
+          authenticatorData: encode(credential.response.authenticatorData),
+          signature: encode(credential.response.signature),
+          userHandle: credential.response.userHandle ? encode(credential.response.userHandle) : null
+        }
+      })
+      this.confirmed = true
+      this.form.requestSubmit(event.submitter)
+    } catch (error) {
+      this.errorTarget.textContent = 'Security key confirmation failed. Try again.'
+    }
+  }
+}

data/app/assets/javascripts/lato/controllers/lato_account_webauthn_controller.js

@@ -83,11 +83,14 @@ export default class extends Controller {
 
   showError(message) {
     if (this.hasStatusTarget) {
-      this.statusTarget.innerHTML = `
-        <div class="alert alert-danger">
-          <h4 class="alert-heading">${message}</h4>
-        </div>
-      `
+      const alert = document.createElement('div')
+      alert.className = 'alert alert-danger'
+      alert.setAttribute('role', 'alert')
+      const heading = document.createElement('h4')
+      heading.className = 'alert-heading'
+      heading.textContent = message
+      alert.appendChild(heading)
+      this.statusTarget.replaceChildren(alert)
     }
   }
 }

data/app/assets/javascripts/lato/controllers/lato_action_controller.js

@@ -17,6 +17,7 @@ export default class extends Controller {
   connect() {
     this.bsModals = []
     this.usedModals = []
+    this.returnFocusElements = []
 
     this.modalTargets.forEach((modalTarget, index) => {
       this.bsModals.push(new bootstrap.Modal(modalTarget))
@@ -39,10 +40,16 @@ export default class extends Controller {
           }
         }, 1)
       })
+      // Programmatic show() does not restore focus like data-bs-toggle does: give it back to the trigger.
+      modalTarget.addEventListener('hidden.bs.modal', () => {
+        const element = this.returnFocusElements[index]
+        this.returnFocusElements[index] = null
+        if (element && element.isConnected) element.focus()
+      })
       modalTarget.addEventListener('hide.bs.modal', () => {
         setTimeout(() => {
           this.usedModals = this.usedModals.filter((i) => i != index)
-          this.modalBodyTargets[index].innerHTML = ''
+          this.modalBodyTargets[index].replaceChildren()
         }, 500)
       })
     })
@@ -56,12 +63,12 @@ export default class extends Controller {
 
     // clean modalTitle content
     this.modalTitleTargets.forEach((modalTitleTarget) => {
-      modalTitleTarget.innerHTML = ''
+      modalTitleTarget.textContent = ''
     })
 
     // clean modalBody content
     this.modalBodyTargets.forEach((modalBodyTarget) => {
-      modalBodyTarget.innerHTML = ''
+      modalBodyTarget.replaceChildren()
     })
   }
 
@@ -108,19 +115,22 @@ export default class extends Controller {
     const index = this.getFreeModalIndex()
 
     if (options.turboFrame && options.turboFrame != '_top') {
-      this.modalBodyTargets[index].innerHTML = `
-      <turbo-frame id="${options.turboFrame}">
-      <div class="placeholder-glow">
-        ${Array(options.actionRows).fill().map(() => `<span class="placeholder placeholder-lg col-12"></span>`).join('')}
-      </div>
-      </turbo-frame>
-      `
-
-      if (options.actionTitle) {
-        this.modalTitleTargets[index].innerHTML = options.actionTitle
-      } else {
-        this.modalTitleTargets[index].innerHTML = ''
+      // Build nodes instead of HTML strings: frame id and title come from element attributes.
+      const turboFrame = document.createElement('turbo-frame')
+      turboFrame.id = options.turboFrame
+      turboFrame.setAttribute('aria-busy', 'true')
+      turboFrame.addEventListener('turbo:frame-load', () => turboFrame.removeAttribute('aria-busy'), { once: true })
+      const placeholder = document.createElement('div')
+      placeholder.className = 'placeholder-glow'
+      for (let i = 0; i < options.actionRows; i++) {
+        const row = document.createElement('span')
+        row.className = 'placeholder placeholder-lg col-12'
+        placeholder.appendChild(row)
       }
+      turboFrame.appendChild(placeholder)
+      this.modalBodyTargets[index].replaceChildren(turboFrame)
+
+      this.modalTitleTargets[index].textContent = options.actionTitle || ''
 
       if (options.actionSize) {
         this.modalDialogTargets[index].classList.remove('modal-md')
@@ -130,6 +140,7 @@ export default class extends Controller {
         this.modalDialogTargets[index].classList.add(`modal-${options.actionSize}`)
       }
 
+      this.returnFocusElements[index] = document.activeElement
       this.bsModals[index].show()
     }
   }

data/app/assets/javascripts/lato/controllers/lato_confirm_controller.js

@@ -18,36 +18,46 @@ export default class extends Controller {
         if (bsModalBackdropElement) bsModalBackdropElement.style.zIndex = 2000
       }, 1)
     })
+
+    // Any dismissal (backdrop, ESC, close button) must settle the pending confirm, otherwise the form hangs.
+    this.element.addEventListener('hidden.bs.modal', () => {
+      this.resolveConfirm(false)
+      this.modalBodyTarget.textContent = ''
+      // Programmatic show() does not restore focus like data-bs-toggle does: give it back to the trigger.
+      if (this._returnFocusElement && this._returnFocusElement.isConnected) this._returnFocusElement.focus()
+      this._returnFocusElement = null
+    })
   }
 
   disconnect() {
+    this.resolveConfirm(false)
     Turbo.config.forms.confirm = window.confirm
   }
 
-  async customConfirm(message) {
-    this.modalBodyTarget.innerHTML = message
+  customConfirm(message) {
+    this.resolveConfirm(false)
+    this._returnFocusElement = document.activeElement
+    // textContent: the message comes from data-turbo-confirm and may include user data.
+    this.modalBodyTarget.textContent = message
     this.modal.show()
 
-    this._result = undefined
-    while (this._result === undefined) {
-      await new Promise(resolve => setTimeout(resolve, 100))
-    }
-
-    return this._result
+    return new Promise(resolve => { this._resolve = resolve })
   }
 
   confirmSuccess() {
-    this.hideModal()
-    this._result = true
+    this.resolveConfirm(true)
+    this.modal.hide()
   }
 
   confirmCancel() {
-    this.hideModal()
-    this._result = false
+    this.resolveConfirm(false)
+    this.modal.hide()
   }
 
-  hideModal() {
-    this.modal.hide()
-    setTimeout(() => this.modalBodyTarget.innerHTML = '', 500)
+  resolveConfirm(result) {
+    if (!this._resolve) return
+
+    this._resolve(result)
+    this._resolve = null
   }
 }

data/app/assets/javascripts/lato/controllers/lato_copyclip_controller.js

@@ -10,6 +10,18 @@ export default class extends Controller {
     if (this.hasButtonTarget) {
       this.buttonTargetOriginalHTML = this.buttonTarget.innerHTML
     }
+
+    // Live region created up front: screen readers only announce changes to a region already in the DOM.
+    this.statusElement = document.createElement('span')
+    this.statusElement.className = 'visually-hidden'
+    this.statusElement.setAttribute('role', 'status')
+    this.statusElement.setAttribute('aria-live', 'polite')
+    this.element.appendChild(this.statusElement)
+  }
+
+  disconnect() {
+    if (this._copyTimeout) clearTimeout(this._copyTimeout)
+    this.statusElement?.remove()
   }
 
   onButtonClick(e) {
@@ -18,7 +30,7 @@ export default class extends Controller {
     this.copy()
   }
 
-  copy() {
+  async copy() {
     if (!this.hasInputTarget) return
 
     // Copy the text inside the text field
@@ -26,16 +38,22 @@ export default class extends Controller {
     this.inputTarget.setSelectionRange(0, 99999) // For mobile devices
 
     // Copy the text inside the text field
-    navigator.clipboard.writeText(this.inputTarget.value)
+    try {
+      await navigator.clipboard.writeText(this.inputTarget.value)
+    } catch (error) {
+      console.error(error)
+      return
+    }
+
+    const copiedText = (this.hasButtonTarget && this.buttonTarget.dataset.copyText) || 'Copied!'
+    this.statusElement.textContent = copiedText
 
     // Manage button state
-    if (this.hasButtonTarget) {
-      this.buttonTarget.innerHTML = this.buttonTarget.dataset.copyText || 'Copied!'
-      
-      if (this._copyTimeout) clearTimeout(this._copyTimeout)
-      this._copyTimeout = setTimeout(() => {
-        this.buttonTarget.innerHTML = this.buttonTargetOriginalHTML
-      }, 2000)
-    }
+    if (this._copyTimeout) clearTimeout(this._copyTimeout)
+    if (this.hasButtonTarget) this.buttonTarget.textContent = copiedText
+    this._copyTimeout = setTimeout(() => {
+      if (this.hasButtonTarget) this.buttonTarget.innerHTML = this.buttonTargetOriginalHTML
+      this.statusElement.textContent = ''
+    }, 2000)
   }
 }

data/app/assets/javascripts/lato/controllers/lato_form_controller.js

@@ -30,6 +30,7 @@ export default class extends Controller {
   // This event is used to remove the Bootstrap invalid class from the input when the user starts typing.
   onInputChange(e) {
     e.target.classList.remove('is-invalid')
+    e.target.removeAttribute('aria-invalid')
   }
 
   // NOTE: You can use this method to submit the form from outside the form or from custom DOM actions.

data/app/assets/javascripts/lato/controllers/lato_index_controller.js

@@ -1,6 +1,9 @@
 import { Controller } from "@hotwired/stimulus"
 
 export default class extends Controller {
+  static values = {
+    key: String
+  }
 
   /**
    * Stimulus
@@ -15,7 +18,7 @@ export default class extends Controller {
 
   // This event is used to reset the pagination when the user types in the search input to start a new search.
   onSearchKeyUp(e) {
-    const pageInput = this.element.querySelector('input[name="page"]')
+    const pageInput = this.element.querySelector(`input[name="${this.keyValue}_page"]`)
     if (pageInput) pageInput.value = 1
   }
 }

data/app/controllers/concerns/lato/componentable.rb

@@ -35,14 +35,7 @@ module Lato
         if collection.respond_to?(:lato_index_search)
           collection = collection.lato_index_search(search)
         else
-          query = @_lato_index[key][:searchable_columns].map do |key|
-            if collection.column_for_attribute(key).type == :string || collection.column_for_attribute(key).type == :text
-              "LOWER(#{key}) LIKE :search"
-            else
-              "CAST(#{key} AS TEXT) LIKE :search"
-            end
-          end
-          collection = collection.where(query.join(' OR '), search: "%#{search.downcase.strip}%")
+          collection = collection.where(lato_index_search_condition(collection, @_lato_index[key][:searchable_columns], search))
         end
       end
 
@@ -64,6 +57,25 @@ module Lato
 
     private
 
+    # Built with Arel so columns are quoted and the CAST type fits the adapter (MySQL has no CAST AS TEXT).
+    # LIKE wildcards typed by the user are escaped, so "%" and "_" match literally.
+    def lato_index_search_condition(collection, columns, search)
+      escape_character = '!'
+      pattern = "%#{ActiveRecord::Base.sanitize_sql_like(search.downcase.strip, escape_character)}%"
+      cast_type = collection.connection.adapter_name.match?(/mysql|trilogy/i) ? 'CHAR' : 'TEXT'
+      table = collection.arel_table
+
+      columns.map do |column|
+        attribute = table[column]
+        value = if %i[string text].include?(collection.column_for_attribute(column).type)
+          Arel::Nodes::NamedFunction.new('LOWER', [attribute])
+        else
+          Arel::Nodes::NamedFunction.new('CAST', [attribute.as(Arel.sql(cast_type))])
+        end
+        value.matches(pattern, escape_character)
+      end.reduce(:or)
+    end
+
     def parse_lato_index_sort_by(sort_by, sortable_columns)
       sort_by_column, sort_by_order = sort_by.to_s.split("|", 2)
       sort_by_column = sort_by_column.to_s

data/app/controllers/concerns/lato/sessionable.rb

@@ -32,35 +32,77 @@ module Lato
 
     def limit_requests(limit = 10, time_window = 10.minutes)
       cache_key = "Lato::Sessionable/limit_requests/#{controller_name}/#{action_name}/#{request.remote_ip}"
-      attempts = Rails.cache.read(cache_key) || 0
-      
-      attempts += 1
-      Rails.cache.write(cache_key, attempts, expires_in: time_window)
-      return true unless attempts >= limit
+      # increment is atomic on shared stores, so parallel requests can not slip past the limit.
+      attempts = Rails.cache.increment(cache_key, 1, expires_in: time_window).to_i
+      return true if attempts <= limit
 
+      respond_to_too_many_requests(time_window)
+      false
+    end
+
+    # Per-account throttle on failed attempts: complements the per-IP limit against distributed brute force.
+    ACCOUNT_LIMIT_ATTEMPTS = 10
+    ACCOUNT_LIMIT_TIME_WINDOW = 15.minutes
+
+    def account_limit_reached?(identifier)
+      return false if identifier.blank?
+
+      reached = Rails.cache.read(account_limit_cache_key(identifier), raw: true).to_i >= ACCOUNT_LIMIT_ATTEMPTS
+      respond_to_too_many_requests(ACCOUNT_LIMIT_TIME_WINDOW) if reached
+      reached
+    end
+
+    def account_limit_track_failure(identifier)
+      return if identifier.blank?
+
+      Rails.cache.increment(account_limit_cache_key(identifier), 1, expires_in: ACCOUNT_LIMIT_TIME_WINDOW)
+    end
+
+    def account_limit_reset(identifier)
+      Rails.cache.delete(account_limit_cache_key(identifier)) if identifier.present?
+    end
+
+    def account_limit_cache_key(identifier)
+      "Lato::Sessionable/account_limit/#{Digest::SHA256.hexdigest(identifier.to_s.downcase.strip)}"
+    end
+
+    def respond_to_too_many_requests(time_window)
+      message = I18n.t('lato.too_many_requests', minutes: (time_window.to_i / 60.0).ceil)
       respond_to do |format|
-        format.html { render plain: "Too many requests, please wait #{time_window.to_i / 60} minutes to retry.", status: :too_many_requests }
-        format.json { render json: {}, status: :too_many_requests }
+        format.html { render plain: message, status: :too_many_requests }
+        format.json { render json: { error: message }, status: :too_many_requests }
       end
-
-      false
     end
 
     def session_create(user_id)
-      # httponly keeps the cookie out of reach of injected scripts; secure avoids leaking it over plain HTTP.
+      @session&.destroy
+      reset_session
+      write_session_cookie(Lato::Session.generate_session_per_user(user_id))
+    end
+
+    def session_update(extra_params)
+      value = @session.update(extra_params)
+      return false unless value
+
+      write_session_cookie(value)
+    end
+
+    def write_session_cookie(value)
+      @session = Lato::Session.new(value)
       cookies.encrypted[:lato_session] = {
-        value: Lato::Session.generate_session_per_user(user_id),
-        expires: Lato.config.session_lifetime.from_now,
+        value: value,
+        expires: @session.expires_at,
         httponly: true,
-        secure: request.ssl?
+        secure: request.ssl?,
+        same_site: :lax
       }
-      @session = Lato::Session.new(cookies.encrypted[:lato_session])
-
       true
     end
 
     def session_destroy
-      cookies.encrypted[:lato_session] = nil
+      @session&.destroy
+      cookies.delete(:lato_session)
+      reset_session
 
       true
     end