I want to implement login and logout session in my website through which after a set of time the session should expire automatically. And if user logged in then the user could not go back.
-
1There is already existing contrib app in django itself docs.djangoproject.com/en/1.10/topics/http/sessions. You don't need to implement anything– Sardorbek ImomalievNov 10, 2016 at 7:39
-
but in my case there is no session time out and if user logged in he/she can easily go back after logged out.– Mandeep ThakurNov 10, 2016 at 7:42
-
There is settings param for setting timeout. docs.djangoproject.com/en/1.10/ref/settings/…. By default it set to 2 weeks. you can change it to any period you want– Sardorbek ImomalievNov 10, 2016 at 7:44
-
how to change that period ?– Mandeep ThakurNov 10, 2016 at 7:57
2 Answers
In your settings.py
set https://docs.djangoproject.com/en/dev/ref/settings/#std:setting-SESSION_COOKIE_AGE.
For example if you want time out to be one hour
SESSION_COOKIE_AGE = 3600 # one hour in seconds
To "settings.py", set SESSION_COOKIE_AGE which is 1209600 seconds(2 weeks) by default and SESSION_SAVE_EVERY_REQUEST which is "False" by default as shown below:
# "settings.py"
SESSION_COOKIE_AGE = 180 # 3 minutes. "1209600(2 weeks)" by default
SESSION_SAVE_EVERY_REQUEST = True # "False" by default
If SESSION_SAVE_EVERY_REQUEST is "True", users are logged out if inactive.
If SESSION_SAVE_EVERY_REQUEST is "False", users are logged out whether active or inactive.