Freshrss: Suggestion: Make the login timeout larger than 30 days

[C0rn3j]

Currently, login expires after 30 days.

Having to login to my own service every 30 days is inconvenient, would it make sense to increase the timeout to be indefinite, or just a very long time? (1 year or longer)

[Frenzie]

I agree about the default. Note that it can be adjusted (at the bottom):

[C0rn3j]

Do you think changing the default to 31536000 (365 days) would be a good new default then?

I think I identified the responsible files so I can send a PR.

EDIT: Went ahead and sent a PR

[Alkarex]

Could someone try to find a reference to a good practice somewhere?

[C0rn3j]

It really differs from site to site, some examples I can think of:

• Nextcloud does 1 year.
• Helpscout(ticketing system) does 30 days, so does Runescape(game).
• Google seems to refresh the cookies to keep them alive but requires password re-entry for certain actions or if the client changed too much (different device/browser on the same cookie).
• Tt-rss expires the cookie on the smallest UA change (which is absolutely terrible UX considering browsers update often).
• Some sites limit the cookie to an IP with an optional checkbox.
• Some sites have indefinite or practically indefinite cookies.

[Frenzie]

I think 3 is about the minimum to avoid the worst of the "ugh, again!?" response.

[Alkarex]

We should look into refreshing the cookie. I actually thought we already were doing it :-P

[Alkarex]

Sorry for the delay; here is patch at last https://github.com/FreshRSS/FreshRSS/pull/3287
Please give it a try 🎄