How to make a session last longer?

Question

I use this to create a session for a user:

put_session(conn, :user_id, user_id)

but it expires quite fast, in about a day I think. I want it be around 2 weeks. How can I specify a time frame within which it's valid?

score 6 · Accepted Answer · answered Mar 09 '17 at 15:11

By default session cookies do not have an expiry date set, which creates a session cookie that exists until the user closes the browsing session. You can set a specific duration by passing max_age: <integer> to the plug Plug.Session call in lib/my_app/endpoint.ex:

Change:

plug Plug.Session,
  store: :cookie,
  key: "_my_app_key",
  signing_salt: "..."

to:

plug Plug.Session,
  store: :cookie,
  key: "_my_app_key",
  signing_salt: "...",
  max_age: 2 * 7 * 24 * 60 * 60 # number of seconds in 2 weeks

You can verify this by inspecting the set-cookie headers from your app. They'll turn from:

$ curl -I localhost:4000 | grep set-cookie

set-cookie: _my_app_key=SFMyNTY.g3QAAAABbQAAAANmb29GP-MM4khcFDg.V3iUo5xw9HqgCmvRLBvhRguMixOlzZH_pqxRIYVAwdQ; path=/; HttpOnly

to:

$ curl -I localhost:4000 | grep set-cookie

set-cookie: _my_app_key=SFMyNTY.g3QAAAABbQAAAANmb29GP-M66RqWt64.6PvtX96B9jwgyIhjJBX5AiDV9_96838plEpgGxS9u0Q; path=/; expires=Thu, 23 Mar 2017 15:06:48 GMT; max-age=1209600; HttpOnly

actually no, I close my browser, then open it and it's still alive. — Junidi, Mar 09 '17 at 15:37
@Junidi That's because for example Chrome doesn't kill your session after restarts, you gotta change the settings for that I believe — NoDisplayName, Mar 09 '17 at 16:23
Yep, http://stackoverflow.com/questions/10617954/chrome-doesnt-delete-session-cookies. — Dogbert, Mar 09 '17 at 16:25

NoDisplayName · Answer 2 · 2017-03-09T21:51:23.240

0

You are putting it into a session which has limited flexibility. You can create a separate cookie, as one way to go and set its max_age like this:

put_resp_cookie(conn, :user_id, user_id, max_age: 30 * 24 * 60 * 60)

edited Mar 09 '17 at 21:51

answered Mar 09 '17 at 13:41

NoDisplayName

15,246
12
62
98

1

so every will be able to edit their cookie and login on behalf on other user?!! – Junidi Mar 09 '17 at 14:07
1

@Junidi That's just the way how to handle this situation, handling the security issues is off the question. – NoDisplayName Mar 09 '17 at 16:22

How to make a session last longer?

2 Answers2