1

I am coming from a .NET/C# authentication and session environment. I have used {% requireLogin %} to create a secure area on the front-end of my website, but it seems that the login credential (or cookie) stays persistent after the browser is closed. There does seem to be time factor as the next day a login is required, but the same day after a somewhat short period with the browser being closed I can relaunch the browser and I have full access to the secure areas and the system knows my user account, etc...

Looking for some direction to explain the Craft security and cookie lifespan in more detail.

| improve this question | |
0

You're probably looking for the userSessionDuration config setting where you can adjust the length of time an authenticated Craft session should have (or just have it session/browser based).

Other related session config settings you might be interested in:

https://craftcms.com/docs/config-settings#elevatedSessionDuration

https://craftcms.com/docs/config-settings#rememberedUserSessionDuration

| improve this answer | |
  • Follow up question: I see how userSessionDuration works. Is there a way to have that value and then also a setting that kills the session immediately when the browser is closed? – Chip Shank Mar 6 '17 at 22:21
  • From the docs: "Set to false if you want users to stay logged in as long as their browser is open rather than a predetermined amount of time." – Brad Bell Mar 6 '17 at 23:20
  • Thanks. I did do that and it works ok. I was also hoping there was something that would create a session 'timeout' even if the browser stays open and at the same time, the session would immediately be 'killed' if the browser is closed. Thanks again. – Chip Shank Mar 7 '17 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.