HyphaApp / hypha

Submission management software for open calls
https://www.hypha.app
BSD 3-Clause "New" or "Revised" License
67 stars 39 forks source link

Add a Remeber me checkbox to login that extend session time. #3926

Closed frjo closed 3 months ago

frjo commented 3 months ago

Fixes #3897

"Remember me" is only available when logging in with password. I see this as an "advanced" feature. The passwordless login flow is easy so not a big hassle to do it once a day.

Organisation that wants to can set SESSION_COOKIE_AGE to a custom value, e.g. set it to two weeks to reagin the old behaviour.

To disable "Remember me" set SESSION_COOKIE_AGE to the same value as SESSION_COOKIE_AGE_LONG

This PR also:

Test Steps

theskumar commented 3 months ago

I believe this will add this only to login with password view, should it be added to passwordless login as well?

theskumar commented 3 months ago

Probably little late here, but I believe using an "incognito" or "guest" mode in the browser is probably the safest way to use hypha if it's not used on their own computer. Security + Privacy.

Wondering if it would make sense to use a verbatim like this in the form as well?

Screenshot 2024-05-15 at 11  53 08@2x

frjo commented 3 months ago

I'm still thinking about how to implement it for passwordless. I assume we need to add something to the login link we send via e-mail that indicated the "remember me" part.

Better solution?

wes-otf commented 3 months ago

@frjo testing this now, did you get any solutions for the passwordless side of things? I personally like the url/query param solution, removes the burden from us of having to store any unneeded data/weird user states.

wes-otf commented 3 months ago

worked well! verified cookie age is as expected