# Session Timeout

**URL:** <https://meta.discourse.org/t/session-timeout/34686>\
**Category:** Data & reporting\
**Created:** [October 19, 2015, 7:26pm UTC](https://meta.discourse.org/t/session-timeout/34686 "2015-10-19T19:26:35Z")\
**Posts on this page:** 1\
**Showing post:** 24

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [May 15, 2016, 12:49pm UTC](https://meta.discourse.org/t/session-timeout/34686/24 "2016-05-15T12:49:07Z")

</div>

The \_t cookie is the wrong spot imo, we should start off by adding a column to user table that specifies when the auth token was created

Then it is trivial to expire cause a site setting can check for stale tokens when doing current user resolution

I do not like the idea of having this logic up to clients, cause clients can cheat

---

_[View the full topic](https://meta.discourse.org/t/session-timeout/34686)._