1811423 - Move max cookie lifetime into params or default preferences

Status: NEW

(Bugzilla :: Administration, enhancement)

Description

[Dave Miller [:justdave]]

The IT Security departments at some businesses don't like how long Bugzilla lets you stay logged in for, and would like to be able to make the inactivity timeout shorter. Bugzilla defaults to 30 days before expiring a login cookie. It is common in many enterprise environments for an application login to last only 15 to 30 minutes, for example. We should make this admin-configurable instead of it being hard-coded in the application.

This is currently set in Bugzilla/Constants.pm:

# How many days a logincookie will remain valid if not used.
use constant MAX_LOGINCOOKIE_AGE => 30;

Note that it's measured in days and not minutes though.

The code that handles it is in Bugzilla/Auth/Persist/Cookie.pm:

  # Issuing a new cookie is a good time to clean up the old
  # cookies.
  $dbh->do("DELETE FROM logincookies WHERE lastused < "
      . $dbh->sql_date_math('LOCALTIMESTAMP(0)', '-', MAX_LOGINCOOKIE_AGE, 'DAY'));

We could move this either into the Parameters, or perhaps make it a user preference if an admin wants to allow end users to set it for their own account, but the admin could also lock the preference to enforce something system wide.

Making it a parameter would be better performance. Deleting expired cookies would be complicated and time consuming if every user has a different max age.