Why doesn't SESSION_EXPIRE_AT_BROWSER_CLOSE = True log the user out when the browser is closed?

Question

According to Django documentation, "if SESSION_EXPIRE_AT_BROWSER_CLOSE is set to True, Django will use browser-length cookies -- cookies that expire as soon as the user closes his or her browser. Use this if you want people to have to log in every time they open a browser."

And that is what I did by adding the following line to my settings.py file (and restarting the server):

# Close the session when user closes the browser
SESSION_EXPIRE_AT_BROWSER_CLOSE = True

Then I logged into a page which checks if the user is authenticated, and then I closed the browser. When I open my browser again and visit the same page it does not ask for a username and a password because it passes the following test apparently:

def check_teacher(request):
    result = {}
    if request.user.is_authenticated():
        ...

What am I doing wrong or what am I missing? Any suggestions?

I'm using Django version 1.3 pre-alpha SVN-13858 on my Ubuntu GNU/Linux 10.10 system and running the above example using the Django development server.

You've probably already got a long-lived cookie stored in your browser from before you changed it to a session one. Try deleting your cookies. — Daniel Roseman, Oct 20 '10 at 10:12
It worked but only once :( I deleted the cookies and active logins in my Firefox (using Tools -> Clear Recent History) then closed the browser and when I tried to visit the page again it asked for username and password. I entered and then closed the browser, then opened it again, visited the same page but this time it did not ask again. I closed and re-opened for a few times and unfortunately it never logged me off again. — Emre Sevinç, Oct 20 '10 at 10:33

score 23 · Accepted Answer · answered Oct 20 '10 at 17:27

23

Closing the tab or window does not count as closing the browser. Make sure you quit the browser program to end a browser session.

If that does not help, use FireBug in firefox or Web Inspector in Safari to double check the headers in the response on your initial page hit. The initial page hit can be one of many things; when you first open the browser, when you logout or immediately after clearing cookies. With SESSION_EXPIRE_AT_BROWSER_CLOSE = True you should see something like this in the header:

Set-Cookie:sessionid=f4c06139bc46a10e1a30d5f0ab7773e2; Path=/

And when SESSION_EXPIRE_AT_BROWSER_CLOSE = False an expires=... value will be added:

Set-Cookie:sessionid=a532f3d7dc314afc58e8f676ed72280e; expires=Wed, 03-Nov-2010 17:08:45 GMT; Max-Age=1209600; Path=/

If you have a hard time seeing the Set-Cookie header because of redirects you can try using django-debug-toolbar to break the redirects up into multiple pages.

answered Oct 20 '10 at 17:27

istruble

13,363
2
47
52

The situation is a bit clear for me now: When I keep the tab that includes my Django app open and tell Firefox to "save my tabs and windows for the next time it starts", and then close and re-start the Firefox, that tab is also opened and I can continue inside the app without having to log in. However if I close that tab, then exit the Firefox (and again tell it to save my tabs), re-start and open a new tab, visit the app's page then I'm forced to log in. – Emre Sevinç Oct 21 '10 at 14:58
1

I have never looked into the save-for-next-time behavior of FF but it sounds like it might be storing cookies across browser instances. Double check the headers that you are sending between each instance of FF. I would not worry about it too much. If you are still curious, there is some discussion about cookies on this page that suggests that FF may be storing all cookies: https://wiki.mozilla.org/Session_Restore – istruble Oct 21 '10 at 16:18
Yes, it seems to store them (I could not find any other explanation for the behaviour I describe in my comment above). – Emre Sevinç Oct 22 '10 at 08:14

score 6 · Answer 2 · answered Aug 30 '13 at 21:27

@istruble and @haasfsafas are both correct. The solution is to

Set SESSION_EXPIRE_AT_BROWSER_CLOSE = True
Delete the rows in the django_session table to clear out any sessions that might cause confusion. (delete from django_session)
Recognize that all of the windows and tabs in your browser must be closed in order for the session to expire. That's browser behavior; not Django behavior.

score 1 · Answer 3 · edited Mar 05 '15 at 10:51

1

You have to cleanup the sessions in DB:

delete FROM django_session

edited Mar 05 '15 at 10:51

Paco

4,520
3
29
53

answered May 29 '12 at 10:11

haasfsafas

27
1

3

I think you don't need `where 1=1` to delete all rows, `delete FROM django_session` is enough. – Diego Navarro May 29 '12 at 13:59

Reincarnationist · Answer 4 · 2022-02-12T07:39:54.787

1

For anyone who still doesn't fix the issue after trying all the above solutions, here is one more.

Add this SESSION_ENGINE = 'django.contrib.sessions.backends.cache' along with the SESSION_EXPIRE_AT_BROWSER_CLOSE = True

It works out for me, good luck folks.

edited Feb 12 '22 at 07:39

answered Feb 05 '22 at 03:16

Reincarnationist

51
1
8

score 1 · Answer 5 · edited Nov 16 '12 at 01:52

1

The change will not apply unless you run the manage.py syncdb again.

edited Nov 16 '12 at 01:52

B Robster

40,605
21
89
122

answered Sep 07 '11 at 12:19

Andrei Cojocaru

21
1

Why doesn't SESSION_EXPIRE_AT_BROWSER_CLOSE = True log the user out when the browser is closed?

5 Answers5

Linked