[TurboGears] Re: Identity sessions timeout 20 minutes after login

[Jeff Watkins]

Jason, you have a good point. I'm surprised I never noticed it. But we don't want to re-issue the cookie, because then if your browser is configured to confirm cookies, you'll get a confirmation for every page load. That would be bad. It looks like I'll take your suggestion and move the expiration to the secret token. This means a change to the data model, but I think it's the right idea. I hope to get to this in the next day or two. On 22 Dec, 2005, at 9:11 pm, Jason Chu wrote: Because the expiry date is stored in the user's cookie and the user's cookie is never updated, Identity sessions timeout every 20 minutes without fail. http://trac.turbogears.org/turbogears/ticket/252 I've written a patch to fix it, but I'd prefer to have the expiry date stored in the secret token rather than in the cookie. Jason -- Jeff Watkins http://newburyportion.com/ 'I know about people who talk about suffering for the common good. It's never bloody them! When you hear a man shouting "Forward, brave comrades!" you'll see he's the one behind the bloody big rock and the one wearing the only really arrow-proof helmet!' -- Rincewind gives a speech on politics. (Terry Pratchett, Interesting Times)