Cookie lifetime about lockup HOT 6 CLOSED

from lockup.

We have a university project that we need to share with our project partner and they felt that a cookie lifespan of 5years is unsecure. So they wanted to be prompted for their password more often ^^
I forked the repo and made the lifetime customisable via an environment variable or the secrets.yaml

from lockup.

Ah, interesting scenario @MariusDanner.

My original vision for Lockup never meant for it to be actual security, but more of a stop-gap against casual bad actors, mistaken access, or search engines for in-development projects.

Couple that vision with the fact that simply changing the passcode will prompt someone to re-authenticate (with the new code, of course) and I’m not sure it makes much sense to add another feature/preference to the gem. I like the existing simplicity.

What do you think @danrabinowitz?

from lockup.

Sorry, I'm offline for a few days. I'll look at this sometime this week.

from lockup.

I don't see any reason not to allow custom behavior, since it's so simple: #37

from lockup.

Handled by #37

from lockup.