Skip to content

docs(config): clarify remember_login_cookie_lifetime behavior and scope #58792

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joshtrichards wants to merge 2 commits into
base: master
Choose a base branch
from
+12 −3
Open

docs(config): clarify remember_login_cookie_lifetime behavior and scope #58792

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
13a2c7e
docs(config): clarify `remember_login_cookie_lifetime` behavior and s…
joshtrichards Mar 8, 2026
a43384a
chore(config): further revise remember_login_cookie_lifetime entry
joshtrichards Mar 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions config/config.sample.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -334,10 +334,19 @@
*/

/**
* Lifetime of the remember login cookie. This should be larger than the
* session_lifetime. If it is set to 0, remember me is disabled.
* Lifetime of logins where the user selected "Remember me", in seconds.
*
* Defaults to ``60*60*24*15`` seconds (15 days)
* A value >``0`` means "Remember me" is available.
* To make "Remember me" unavailable to users, set to ``0``.
*
* To avoid unexpected expiry, set this higher than ``session_lifetime``.
*
* Despite the key name, this value applies to the full remember-me mechanism:
* persisted login state in the browser (remember-login cookies) and server-side
* expiration of remembered login tokens. Therefore, changing or clearing cookies
* alone may not fully reset remembered login state.
Comment on lines +346 to +347
Copy link
Copy Markdown
Contributor

@come-nc come-nc Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clearing the cookie in the browser? How could that not log you out?

I feel like you dived into the rememberme effects and know more than me, but what I’m reading in these two PR is confusing 🙈

Copy link
Copy Markdown
Member Author

@joshtrichards joshtrichards Mar 9, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I went back and forth on how to document this. I wanted to leave out server-side implementation details since the audience is meant to be more admin-oriented, but I also wanted to keep it honest just in case there were some weird side effects that might impact admin-level troubleshooting. Clearing the cookies from the browser will effectively result in clearing things, but - technically - the server-side storage of the remember-me session token will still stick around until the server-side piece happens:

server/lib/private/Authentication/Token/PublicKeyTokenProvider.php

Lines 266 to 282 in 92cf64f

public function invalidateOldTokens() {
$olderThan = $this->time->getTime() - $this->config->getSystemValueInt('session_lifetime', 60 * 60 * 24);
$this->logger->debug('Invalidating session tokens older than ' . date('c', $olderThan), ['app' => 'cron']);
$this->mapper->invalidateOld($olderThan, OCPIToken::TEMPORARY_TOKEN, OCPIToken::DO_NOT_REMEMBER);
$rememberThreshold = $this->time->getTime() - $this->config->getSystemValueInt('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
$this->logger->debug('Invalidating remembered session tokens older than ' . date('c', $rememberThreshold), ['app' => 'cron']);
$this->mapper->invalidateOld($rememberThreshold, OCPIToken::TEMPORARY_TOKEN, OCPIToken::REMEMBER);
$wipeThreshold = $this->time->getTime() - $this->config->getSystemValueInt('token_auth_wipe_token_retention', 60 * 60 * 24 * 60);
$this->logger->debug('Invalidating auth tokens marked for remote wipe older than ' . date('c', $wipeThreshold), ['app' => 'cron']);
$this->mapper->invalidateOld($wipeThreshold, OCPIToken::WIPE_TOKEN);
$authTokenThreshold = $this->time->getTime() - $this->config->getSystemValueInt('token_auth_token_retention', 60 * 60 * 24 * 365);
$this->logger->debug('Invalidating auth tokens older than ' . date('c', $authTokenThreshold), ['app' => 'cron']);
$this->mapper->invalidateOld($authTokenThreshold, OCPIToken::PERMANENT_TOKEN);
}

It's probably such a subtle bit we could leave it out and assume there won't be any troubleshooting side effects for admins. I can't really think of any, unless - well, they clear their cookies then attempt to put them back in their browser or something and then wonder why they still work... ;-) Edit: And anyone that pokes around the database.

*
* Defaults to ``60*60*24*15`` seconds (15 days).
*/
'remember_login_cookie_lifetime' => 60 * 60 * 24 * 15,

Expand Down
Loading