Configurable cookie lifetimes #193

New issue

Closed

opened 2025-12-03 17:09:41 -06:00 by davidedpg10 · 3 comments

davidedpg10 commented

2025-12-03 17:09:41 -06:00

(Migrated from github.com)

Describe your idea for an enhancement:

I think it would be really cool if we could configure the lifetime of cookies to either prevent excessive logging in, or to increase the frequency. Ideally configurable at the ProxyAuth or OIDC level (so that for example one can require more frequent logins for admin stuff, etc)

Describe alternatives you've considered:

I have not explored other alternatives. I know Authentik can do this, however I understand that is a much larger project with greater scope. I may peruse the code to see if I can provide a CR at some point.

Additional context:

From the brief testing I did, under normal circumstances, it saves the cookie with an expiration value of session, which means the login will have to be performed again next time.

When logging in with username/password combination, it allows clicking remember me which will cause the cookie to be saved with an expiration a year later. However this mechanism doesn't seem to work when using Passkey. Regardless of if the box is ticked, it will still just mark the cookie with an expiration time of session

### Describe your idea for an enhancement: I think it would be really cool if we could configure the lifetime of cookies to either prevent excessive logging in, or to increase the frequency. Ideally configurable at the ProxyAuth or OIDC level (so that for example one can require more frequent logins for admin stuff, etc) ### Describe alternatives you've considered: I have not explored other alternatives. I know Authentik can do this, however I understand that is a much larger project with greater scope. I may peruse the code to see if I can provide a CR at some point. ### Additional context: From the brief testing I did, under normal circumstances, it saves the cookie with an expiration value of `session`, which means the login will have to be performed again next time. When logging in with username/password combination, it allows clicking `remember me` which will cause the cookie to be saved with an expiration a year later. However this mechanism doesn't seem to work when using `Passkey`. Regardless of if the box is ticked, it will still just mark the cookie with an expiration time of `session`

👍 3 👀 1

notquitenothing commented

2025-12-26 23:46:18 -06:00

(Migrated from github.com)

Going to release a patch so that the Passkey login will respect the 'Remember Me' checkbox on the login page. 🙂

As for the configurable cookie/session lifetime, I may implement some way to force session freshness when using ProxyAuth Domains, some option that could be set per Domain.

For OIDC Clients, VoidAuth should already support the max_age parameter that clients apps can optionally use to force/verify OIDC re-authentication, but there is no way to force an OIDC Client to ever reach back out to VoidAuth for anything after initial contact. So that will be up to app creators to include configurable time-limits, nothing much I can do there.

Going to release a patch so that the Passkey login will respect the 'Remember Me' checkbox on the login page. 🙂 As for the configurable cookie/session lifetime, I may implement some way to force session freshness when using ProxyAuth Domains, some option that could be set per Domain. For OIDC Clients, VoidAuth should already support the `max_age` parameter that clients apps can optionally use to force/verify OIDC re-authentication, but there is no way to force an OIDC Client to ever reach back out to VoidAuth for anything after initial contact. So that will be up to app creators to include configurable time-limits, nothing much I can do there.

❤️ 1

notquitenothing commented

2025-12-31 11:48:20 -06:00

(Migrated from github.com)

This is released in v1.8.0 as the ability to set a Max Session Age for a ProxyAuth Domain

This is released in [v1.8.0](https://github.com/voidauth/voidauth/releases/tag/v1.8.0) as the ability to set a Max Session Age for a ProxyAuth Domain

❤️ 2

notquitenothing commented

2026-01-02 19:27:48 -06:00

(Migrated from github.com)

Assumed resolved in v1.8.0 . Please re-open if it is not