Pierre-Olivier Mercier
68a783b7bb
- Reduce SESSION_MAX_DURATION from 365 days to 15 days - Add SESSION_RENEWAL_THRESHOLD (7 days): sessions are only extended when fewer than 7 days remain, instead of refreshing on every request - Align cookie MaxAge with SESSION_MAX_DURATION (derived from the constant) - Enforce expiry in load(): expired sessions are deleted on first use and the caller receives an error, preventing Bearer-token replay of stale sessions that the securecookie age check would not catch Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| adapters | ||
| api | ||
| api-admin | ||
| app | ||
| avatar | ||
| captcha | ||
| config | ||
| forms | ||
| helpers | ||
| mailer | ||
| newsletter | ||
| session | ||
| storage | ||
| usecase | ||