Okay, this should be correct in Horde 3.0.5.

This wasn't the right fix; we use the timeout value elsewhere when it 
*is* relative. Reopening.

We don't say anywhere that the value entered there is the expiration 
interval. Instead we even point to the setcookie() documentation 
explicitely.



OTOH it doesn't make sense to enter a fixed value (integer) here, 
because you most likely want to always have a dynamic value there. 
Thus I changed the configuration type so that you now can enter PHP 
code there.

In the file lib/Horde/Secret.php you use many times:



@setcookie($keyname . '_key', $key, $conf['session']['timeout'], 
$conf['cookie']['path'], $conf['cookie']['domain'], $conf

['use_ssl'] == 1 ? 1 : 0);



But the setcookie function expect absolute time of cookie expiration, 
not relative. Therefore the correct form should be:



@setcookie($keyname . '_key', $conf['session']['timeout'] == 0 ? 0 : 
$key, time() + $conf['session']['timeout'], $conf['cookie']['path'], 
$conf['cookie']['domain'], $conf

['use_ssl'] == 1 ? 1 : 0);



Am I right? I lost about 5 hours :-/ to find a problem why the IMP 
application forever reloads when I use cookies. Only MSIE worked (it 
kept the cookie with the time in the past).