request: opposite default behavior for SOCIAL_AUTH_SESSION_EXPIRATION

[gameguy43]

Hey there,

I just had quite a bit of trouble debugging a tricky issue where /some/ of my users were getting logged out just an hour or so after logging in.

After some digging, I learned that the issue was mostly effecting google-oauth2 users.

Finally, I noticed that the issue was the default setting for SOCIAL_AUTH_SESSION_EXPIRATION, which was /overriding/ the SESSION_COOKIE_AGE setting to make user sessions only last as long as the token from the auth provider. In the case of google-oauth2, this is just an hour or so. It was quite confusing that even though I had django setting for SESSION_COOKIE_AGE (set to 1 year), this setting was not being honored.

So I suggest that the /default/ behavior should be to respect SESSION_COOKIE_AGE, with the /option/ to favor the auth provider's 'expires' header.

Happy to write a pull request if project maintainers agree. Thanks!

[omab]

@gameguy43, I think that your request is reasonable and should be applied, I'm look forward that PR.

Thanks!

[gameguy43]

resolved with #358

[eyscode]

Hi, what happen with this commit?, I see the change in the master branch, but not in the latest v0.1.26 on pip (neither in v0.1.24, 0.1.25) Anyone know anything about it? @omab @gameguy43

At the moment, when using google-plus backend, the sessionid expires in 1 hour, unless the SOCIAL_AUTH_SESSION_EXPIRATION is False. @omab @gameguy43

[omab]

@eyscode, the change is not released at the moment, v0.2.0 introduced some backward incompatibles changes and it won't be released until I work on a doc explaining the changes.

[eyscode]

Thanks for the prompt reply.

[omab]

This is released now.

[gameguy43]

👍

[eyscode]

Cool (: