[Tickets #12136] Re: Session Timeout not enforced

[noreply at bugs.horde.org]

DO NOT REPLY TO THIS MESSAGE. THIS EMAIL ADDRESS IS NOT MONITORED.

Ticket URL: http://bugs.horde.org/ticket/12136
------------------------------------------------------------------------------
  Ticket             | 12136
  Updated By         | Michael Slusarz <slusarz at horde.org>
  Summary            | Session Timeout not enforced
  Queue              | Horde Framework Packages
  Version            | Git master
  Type               | Bug
  State              | Feedback
  Priority           | 2. Medium
  Milestone          |
  Patch              |
  Owners             |
------------------------------------------------------------------------------


Michael Slusarz <slusarz at horde.org> (2013-04-16 13:59) wrote:

> as far as i can tell, they make the problem worse, as they combine  
> cookie lifetime and gc_maxlifetime into one config setting. so now i  
> cannot even get the weak security properties of setting  
> gc_maxlifetime, since it also affects cookie lifetime.

Huh?  How does this make things worse?  This doesn't affect session  
timeouts.  This only affects COOKIE timeouts.

You obviously can't enforce session timeouts on the browser side.

The gc code is in there to ensure there is SOME way of enforcing a  
timeout and/or cookies are not being used.  But that code will be  
removed if we make the change to the default value of max_time like I  
already proposed.

> so why even provide this option??

Because people apparently want to be able to close their browser and  
then reopen and not lose their cookies.  I don't agree with it, but  
the configuration option has existed for awhile (and was essentially  
unused otherwise).