Now that my auth changes are all done a ton of stuff is easily on the table.
Personally I think the best change we can make here is:
- (default disabled) “Stay signed in” option for sign in page.
- choose default behavior for sign in (session based vs permanent) - default to permanent
- Add site setting for “maximum session age for session cookie” which should be way lower than 1440 hours which we use for permanent one (probably 24 hours would be a reasonable default), this is a safeguard for people who forget a tab opened
We already have “maximum session age” which is set to 1440 hours, by heavily reducing it we can “sort of” approximate a session based cookie, except that unlike a session based cookie, closing and opening tabs will keep you logged on.
These 3 site settings and bits of UI needed for “stay signed in” option are probably doable in 1-2 days of work.
@codinghorror your call if
- you want these options in core
- you want us to build it vs a community pr