Forum OpenACS Development: Logout on browser close, missing important feature!

If login timeout is empty string require a login cookie. Do not give someone a new login cookie with a valid session cookie.

if {[sec_login_timeout eq "" && [catch [ad_get_signed_cookie_with_expr ad_user_login]} {
sec_login_handler
}

That's the idea. I just wanted to get some feedback first in case I missed something.

Thanks. I will also test that case and report back.

Nope. Persistent login does not behave that way because 1) the login cookie timout parameter has a default value. You can not set it to an empty string to create a session cookie.
So you always have a 1 day persistent cookie unless you set it to a different value. If your login times out AND your session times out, you do have to login again, but it is unrelated to the browser.

2) Due to changes made ages ago, even if the ad_user_login cookie could be a session cookie, if you have an ad_session_id cookie, it will refresh your session if it is within the session timeout even if you don't have a login cookie.

So there are two changes. 1) allow the logintimeout parmeter to have an empty string value. 2) Allow the session handler to deal with a missing login cookie appropriately, if login timeout is an empty string.

I think this patch does that :)

Of course Firfox makes this all more interesting, becuase if you have a tab open with your openacs site and you either have the Open my tabs option selected or firefox askes you if you want to save the open tabs on close, it will ALSO save you session cookies and keep them around, so you won't be logged out, even with a session cookie. So not only do you need to change the code, but users will need to understand how this works in Firefox. To combat this I also have a reasonbly short session timeout of 1 hour. Less than that and users might be annoyed.

I was not familiar with the Discard option that looks like it does the trick.

Does it discard the ad_session_id cookie if persistent login is not checked or allowed? This is the one that was causing a problem since it renewed the session even if your login cookie had expired.