Tickets :: Comment on [#12136] Session Timeout not enforced

* Your Email Address
* Spam protection	Enter the letters below: .___. .. ,.__..__. [__ \|__\| \./ [__]\| \| [___\| \| \| \| \|\|__\|
Comment	>> as far as i can tell, they make the problem worse, as they combine >> cookie lifetime and gc_maxlifetime into one config setting. so now i >> cannot even get the weak security properties of setting >> gc_maxlifetime, since it also affects cookie lifetime. > > Huh? How does this make things worse? This doesn't affect session > timeouts. This only affects COOKIE timeouts. > > You obviously can't enforce session timeouts on the browser side. > > The gc code is in there to ensure there is SOME way of enforcing a > timeout and/or cookies are not being used. But that code will be > removed if we make the change to the default value of max_time like I > already proposed. > >> so why even provide this option?? > > Because people apparently want to be able to close their browser and > then reopen and not lose their cookies. I don't agree with it, but > the configuration option has existed for awhile (and was essentially > unused otherwise).
Attachment
Watch this ticket