# Session Timeout

**URL:** <https://meta.discourse.org/t/session-timeout/34686>\
**Category:** Data & reporting\
**Created:** [October 19, 2015, 7:26pm UTC](https://meta.discourse.org/t/session-timeout/34686 "2015-10-19T19:26:35Z")\
**Posts on this page:** 1\
**Showing post:** 28

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [February 20, 2017, 4:02pm UTC](https://meta.discourse.org/t/session-timeout/34686/28 "2017-02-20T16:02:03Z")

</div>

Now that my auth changes are all done a ton of stuff is easily on the table.

Personally I think the best change we can make here is:

- (default disabled) “Stay signed in” option for sign in page.
- choose default behavior for sign in (session based vs permanent) - default to permanent
- Add site setting for “maximum session age for session cookie” which should be way lower than 1440 hours which we use for permanent one (probably 24 hours would be a reasonable default), this is a safeguard for people who forget a tab opened

We already have “maximum session age” which is set to 1440 hours, by heavily reducing it we can “sort of” approximate a session based cookie, except that unlike a session based cookie, closing and opening tabs will keep you logged on.

These 3 site settings and bits of UI needed for “stay signed in” option are probably doable in 1-2 days of work.

@codinghorror your call if

1. you want these options in core
2. you want us to build it vs a community pr

---

_[View the full topic](https://meta.discourse.org/t/session-timeout/34686)._