Closed frjo closed 3 months ago
I believe this will add this only to login with password view, should it be added to passwordless login as well?
Probably little late here, but I believe using an "incognito" or "guest" mode in the browser is probably the safest way to use hypha if it's not used on their own computer. Security + Privacy.
Wondering if it would make sense to use a verbatim like this in the form as well?
I'm still thinking about how to implement it for passwordless. I assume we need to add something to the login link we send via e-mail that indicated the "remember me" part.
Better solution?
@frjo testing this now, did you get any solutions for the passwordless side of things? I personally like the url/query param solution, removes the burden from us of having to store any unneeded data/weird user states.
worked well! verified cookie age is as expected
Fixes #3897
"Remember me" is only available when logging in with password. I see this as an "advanced" feature. The passwordless login flow is easy so not a big hassle to do it once a day.
Organisation that wants to can set
SESSION_COOKIE_AGE
to a custom value, e.g. set it to two weeks to reagin the old behaviour.To disable "Remember me" set
SESSION_COOKIE_AGE
to the same value asSESSION_COOKIE_AGE_LONG
This PR also:
Test Steps