Add configurable expiry time to "Remember Me" option

[andrew-dwyer]

At the moment the "Remember Me" cookie lasts forever. It would be good to give the store owner an option to limit the period that an admin doesn't have to enter their 2FA code to a set period (e.g. 1 month).

[avoelkl]

An unlimited remember me function is of course bad.

We can implement a limit with a default value or limit the remember-me function for a browser session. Other ideas:

• set it according to the session cookie lifetime for admins
• enable the remember me function for a specific browser (just as Dropbox does for example)

What do you think would be a reasonable value for such a function?

I dislike having a too long-lasting remember me function as would make the 2FA login a bit ridiculous?

[andrew-dwyer]

How about adding a new system config for the expiry time. It makes sense
for it to be longer than the default admin timeout so I don't think they
should be linked. I believe Google offers you an option to remember your
2FA with for a month at a time.

If I get a chance I will try to whip up a pull request.
On 23 Oct 2015 7:08 pm, "Anna Völkl" notifications@github.com wrote:

An unlimited remember me function is of course bad.

We can implement a limit with a default value or limit the remember-me
function for a browser session. Other ideas:

• set it according to the session cookie lifetime for admins
• enable the remember me function for a specific browser (just as
  Dropbox does for example)

What do you think would be a reasonable value for such a function?

I dislike having a too long-lasting remember me function as would make the
2FA login a bit ridiculous?

—
Reply to this email directly or view it on GitHub
#26 (comment)
.

[avoelkl]

Thanks for the lastet PR.
You're right, it should be longer than the default admin timeout.

[ihor-sviziev]

👍