I myself will have a look at the later one. In this case the user should stay active for at least XX minutes otherwise he will loose his session (seems correct to me). > issue: is (almost) the same as 2) this would only work if you can alter the expiration date after setting the cookie.
> issue: setting this high and security is lost and setting it to low will give users a 'session expired' error message which means they have to log in again.ģ) Adding a second cookie with an expiration date. > issue: you should do this with javascript adding vulnerability since the http_only should be set to falseĢ) Setting cookie_lifetime from 0 (when browser closes) to for instance 3600 (1 hour). However I see different issues with different solutions. So I was indeed thinking about fixing this in a script. However I tried several things, for instance setting up the cache control headers, but this won't work for me.
As I think it is a generally a bad idea to let the browser restore an old session.
0 kommentar(er)
