6.0.0-beta6
▾
Tasks
New Task
Search
Photos
Wiki
▾
Tickets
New Ticket
Search
dev.horde.org
Toggle Alerts Log
Help
3/30/26
H
istory
A
ttachments
C
omment
W
atch
Download
Comment on [#12136] Session Timeout not enforced
*
Your Email Address
*
Spam protection
Enter the letters below:
.___. .. ,.__..__. [__ |__| \./ [__]| | [___| | | | ||__|
Comment
>> as far as i can tell, they make the problem worse, as they combine >> cookie lifetime and gc_maxlifetime into one config setting. so now i >> cannot even get the weak security properties of setting >> gc_maxlifetime, since it also affects cookie lifetime. > > Huh? How does this make things worse? This doesn't affect session > timeouts. This only affects COOKIE timeouts. > > You obviously can't enforce session timeouts on the browser side. > > The gc code is in there to ensure there is SOME way of enforcing a > timeout and/or cookies are not being used. But that code will be > removed if we make the change to the default value of max_time like I > already proposed. > >> so why even provide this option?? > > Because people apparently want to be able to close their browser and > then reopen and not lose their cookies. I don't agree with it, but > the configuration option has existed for awhile (and was essentially > unused otherwise).
Attachment
Watch this ticket
N
ew Ticket
M
y Tickets
S
earch
Q
uery Builder
R
eports
Saved Queries
Open Bugs
Bugs waiting for Feedback
Open Bugs in Releases
Open Enhancements
Enhancements waiting for Feedback
Bugs with Patches
Enhancements with Patches
Release Showstoppers
Stalled Tickets
New Tickets
Horde 5 Showstoppers