You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The cookie_max_age_days option can be used to set how long the login cookie signature is valid for, but there's no way to set when the cookie itself actually expires. Currently it just uses Tornado's default of 30 days, so setting cookie_max_age_days to a value greater than 30 also won't work as expected (the cookie will expire before the signature does).
Alternative options
If not being able to change the cookie expiration is intentional then it'd be helpful to just document that for cookie_max_age_days.
Who would use this feature?
Anyone who wants to change when the login cookie expires or set cookie_max_age_days to a value greater than 30.
(Optional): Suggest a solution
expires_days just needs to be passed in when calling set_cookie()here, similar to how max_age_days is passed in to get_secure_cookie()here. That's what the Tornado docs recommend for changing signed cookie expirations also. This could be a new setting or just the same value as cookie_max_age_days, not sure if there's a benefit to making them different. Happy to open a PR with whatever's decided on!
The text was updated successfully, but these errors were encountered:
Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! 🤗
If you haven't done so already, check out Jupyter's Code of Conduct. Also, please try to follow the issue template as it helps other other community members to contribute more effectively.
You can meet the other Jovyans by joining our Discourse forum. There is also an intro thread there where you can stop by and say Hi! 👋
I haven't seen a response to @minrk 's suggestion, which I think is a good one. It seems to me that it could be done by modifying BasicHandler.set_hub_cookie to take an extra parameter. I'd be happy to try it and do a PR if anyone is interested in reviewing it. Any comments on the idea?
Proposed change
The
cookie_max_age_days
option can be used to set how long the login cookie signature is valid for, but there's no way to set when the cookie itself actually expires. Currently it just uses Tornado's default of 30 days, so settingcookie_max_age_days
to a value greater than 30 also won't work as expected (the cookie will expire before the signature does).Alternative options
If not being able to change the cookie expiration is intentional then it'd be helpful to just document that for
cookie_max_age_days
.Who would use this feature?
Anyone who wants to change when the login cookie expires or set
cookie_max_age_days
to a value greater than 30.(Optional): Suggest a solution
expires_days
just needs to be passed in when callingset_cookie()
here, similar to howmax_age_days
is passed in toget_secure_cookie()
here. That's what the Tornado docs recommend for changing signed cookie expirations also. This could be a new setting or just the same value ascookie_max_age_days
, not sure if there's a benefit to making them different. Happy to open a PR with whatever's decided on!The text was updated successfully, but these errors were encountered: