Make sessions last longer

[WesleyAC]

I feel like I get logged out of bookwyrm.social all the time. I think we should default to much longer/more persistent sessions than we do. In the modern era short sessions are generally not considered a security advantage and are quite a nuisance.

Looks like this is as simple as setting SESSION_COOKIE_AGE, which defaults to two weeks. I propose a default value of 4 years (60*60*24*365*4 == 126144000). Thoughts?

[mouse-reeve]

I think this would be very nice. My only question is if having longer-lasting cookies would cause GDPR issues?

[dato]

I think a year should be fine in any case.

Rationale (but I am not a lawyer):

• as I understand it, log-in cookies/authentication cookies fall in the “strictly necessary cookies” category (plus are first-party cookies), and hence do not require informing consent.
• on the other hand, confirmed consent for cookies that require is only valid for 12 months, so using the same time span for log-in seems a nice form of renewing such “implicit consent.”

Still, I think that 4 years is compliant too, though I could see how it could raise an eyebrow. Was there any particular reason for that number, and not 2 or 6? 1 or 2 seem best to me.

[WesleyAC]

https://law.stackexchange.com/questions/44173/cookie-expiration-time-per-gdpr-guidelines has a good summary of GDPR rules, I don't think there's anything really to worry about — we need to keep cookies around for the minimum amount of time that is necessary to achieve their purpose, but there aren't any restrictions on what the purposes may be, so keeping the user logged in for a given amount of time is the purpose. I think for login cookies this essentially means that the expiry date of the cookie needs to be the same as (or less than) the expiry date of the session on the backend, otherwise the cookie would be around for longer than is necessary, but there does not appear to be a restriction on what that amount of time is. This is rather silly, but many parts of GDPR are silly in this kind of way.

I suggested four years since that's a normal period of time for someone to own a device for, the idea being that people should be able to log on once and never have to again until they get a new device. However, I realize I was misinterpreting how session expiry works when I wrote that — the session expiry time is reset every time the session is used. Given that, a year seems fine — that would mean people would get logged out after a year of not accessing bookwyrm, which feels like a reasonable tradeoff between not being annoying to infrequent users and not having sessions kicking around for lokger than they need to be.

[hughrun]

I think this is a good idea but ideally we would implement #2278 first so that users can remotely log out of sessions that are hanging around on old devices.

[skobkin]

Looks like this is as simple as setting SESSION_COOKIE_AGE, which defaults to two weeks.

Looks like it's not that simple. I've tried that on my instance.

~/bookwyrm# fgrep SESSION .env                                                                             
SESSION_COOKIE_AGE=7776000

But it didn't change anything. After logging out and logging back in I've got a session cookie expiring on 2024-02-06 ....

[dato]

Great find, @skobkin, thank you. Your message made me realize this feature needs changes in bookwyrm/settings.py, and hence...

we would implement #2278 first so that users can remotely log out of sessions that are hanging around on old devices

What we could do already, is set a conservative default from settings.py (keep Django's 2 weeks or, say, extend it to one month)— then that default (BookWyrm's default) can be updated once #2278 is implemented, but site admins are able to modify it already, from .env. Everybody wins, I think :)

(I prepared a PR, which I'll be sending shortly.)

[skobkin]

Looking forward for your MR to be merged 👍