613084 - Allow users to stay signed in longer (twitter oauth cookie)

Status: RESOLVED FIXED

(support.mozilla.org :: Army of Awesome, task, P2)

Description

[William Reynolds [:williamr]]

After a short period of inactivity, users are automatically signed out and need to sign in again. We should look into how we can extend the session duration. Not sure if this is a Twitter OAuth issue or a setting in Django.

Comment 1

[Erik Rose [:erik][:erikrose]]

I'll see what I can figure out....

Comment 2

[Erik Rose [:erik][:erikrose]]

It hasn't signed me out in 30 minutes. How short is short?

Comment 3

[William Reynolds [:williamr]]

I believe short is around 1-3 hours. I think we're hitting the session duration because of Twitter OAuth, since each time the user "signs in" to the page they have to allow the Army of Awesome page to post to their twitter account. Ideally, we'd store the OAuth info somewhere server side and users would sign into the site (possibly with a SUMO account) instead of going through twitter each time. That's the flow for most twitter apps and a goal for a future milestone.

With this bug I was hoping to see if there are any short-term fixes to get the most out of the current session handling.

Jesse, what have your experiences been with Army of Awesome sessions ending? Any recommendations?

Comment 4

[Erik Rose [:erik][:erikrose]]

This is interesting, because Twitter claims not to expire their OAuth tokens: http://dev.twitter.com/pages/oauth_faq

Comment 6

[Ricky Rosario [:rrosario, :r1cky]]

I think if we put the token in the session instead of a cookie, we are good. It shouldn't be too complicated... famous last words

Comment 7

[Ricky Rosario [:rrosario, :r1cky]]

Today is the last day of the sprint, this isn't going to make it.

Comment 8

[Ricky Rosario [:rrosario, :r1cky]]

Landed in prod:

https://github.com/mozilla/kitsune/commit/2e7730ebf0e843d375b5e0b3ba4d41226fa568ed