aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authordelvh <dev.lh@web.de>2024-03-28 04:13:42 +0100
committerGitHub <noreply@github.com>2024-03-28 03:13:42 +0000
commit0d5abe3454c73f11d90d2809af0949a0e0636c22 (patch)
tree6b6aa5510347ff1d98bcbea818a4837a4d8e76a9
parent7ba485bd494b0d7a4091806afa73a7f03dc44743 (diff)
downloadgitea-0d5abe3454c73f11d90d2809af0949a0e0636c22.tar.gz
gitea-0d5abe3454c73f11d90d2809af0949a0e0636c22.zip
Remember login for a month by default (#30150)
Previously, the default was a week. As most instances don't set the setting, this leads to a bad user experience by default. ## :warning: Breaking If your instance requires a high level of security, you may want to set `[security].LOGIN_REMEMBER_DAYS` so that logins are not valid as long. --------- Co-authored-by: Jason Song <i@wolfogre.com>
-rw-r--r--custom/conf/app.example.ini2
-rw-r--r--docs/content/administration/config-cheat-sheet.en-us.md2
-rw-r--r--docs/content/administration/config-cheat-sheet.zh-cn.md2
-rw-r--r--modules/setting/security.go2
4 files changed, 4 insertions, 4 deletions
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index b4b4f3a8a2..e2723bd8ae 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -441,7 +441,7 @@ INTERNAL_TOKEN =
;INTERNAL_TOKEN_URI = file:/etc/gitea/internal_token
;;
;; How long to remember that a user is logged in before requiring relogin (in days)
-;LOGIN_REMEMBER_DAYS = 7
+;LOGIN_REMEMBER_DAYS = 31
;;
;; Name of the cookie used to store the current username.
;COOKIE_USERNAME = gitea_awesome
diff --git a/docs/content/administration/config-cheat-sheet.en-us.md b/docs/content/administration/config-cheat-sheet.en-us.md
index 2309021f94..03ab517d80 100644
--- a/docs/content/administration/config-cheat-sheet.en-us.md
+++ b/docs/content/administration/config-cheat-sheet.en-us.md
@@ -528,7 +528,7 @@ And the following unique queues:
- `INSTALL_LOCK`: **false**: Controls access to the installation page. When set to "true", the installation page is not accessible.
- `SECRET_KEY`: **\<random at every install\>**: Global secret key. This key is VERY IMPORTANT, if you lost it, the data encrypted by it (like 2FA secret) can't be decrypted anymore.
- `SECRET_KEY_URI`: **_empty_**: Instead of defining SECRET_KEY, this option can be used to use the key stored in a file (example value: `file:/etc/gitea/secret_key`). It shouldn't be lost like SECRET_KEY.
-- `LOGIN_REMEMBER_DAYS`: **7**: Cookie lifetime, in days.
+- `LOGIN_REMEMBER_DAYS`: **31**: How long to remember that a user is logged in before requiring relogin (in days).
- `COOKIE_REMEMBER_NAME`: **gitea\_incredible**: Name of cookie used to store authentication
information.
- `REVERSE_PROXY_AUTHENTICATION_USER`: **X-WEBAUTH-USER**: Header name for reverse proxy
diff --git a/docs/content/administration/config-cheat-sheet.zh-cn.md b/docs/content/administration/config-cheat-sheet.zh-cn.md
index 3115e4cc06..41c8844ae5 100644
--- a/docs/content/administration/config-cheat-sheet.zh-cn.md
+++ b/docs/content/administration/config-cheat-sheet.zh-cn.md
@@ -507,7 +507,7 @@ Gitea 创建以下非唯一队列:
- `INSTALL_LOCK`: **false**:控制是否能够访问安装向导页面,设置为 `true` 则禁止访问安装向导页面。
- `SECRET_KEY`: **\<每次安装时随机生成\>**:全局服务器安全密钥。这个密钥非常重要,如果丢失将无法解密加密的数据(例如 2FA)。
- `SECRET_KEY_URI`: **_empty_**:与定义 `SECRET_KEY` 不同,此选项可用于使用存储在文件中的密钥(示例值:`file:/etc/gitea/secret_key`)。它不应该像 `SECRET_KEY` 一样容易丢失。
-- `LOGIN_REMEMBER_DAYS`: **7**:Cookie 保存时间,单位为天。
+- `LOGIN_REMEMBER_DAYS`: **31**:在要求重新登录之前,记住用户的登录状态多长时间(以天为单位)。
- `COOKIE_REMEMBER_NAME`: **gitea\_incredible**:保存自动登录信息的 Cookie 名称。
- `REVERSE_PROXY_AUTHENTICATION_USER`: **X-WEBAUTH-USER**:反向代理认证的 HTTP 头部名称,用于提供用户信息。
- `REVERSE_PROXY_AUTHENTICATION_EMAIL`: **X-WEBAUTH-EMAIL**:反向代理认证的 HTTP 头部名称,用于提供邮箱信息。
diff --git a/modules/setting/security.go b/modules/setting/security.go
index 380360a696..3d7b1f9ce7 100644
--- a/modules/setting/security.go
+++ b/modules/setting/security.go
@@ -103,7 +103,7 @@ func generateSaveInternalToken(rootCfg ConfigProvider) {
func loadSecurityFrom(rootCfg ConfigProvider) {
sec := rootCfg.Section("security")
InstallLock = HasInstallLock(rootCfg)
- LogInRememberDays = sec.Key("LOGIN_REMEMBER_DAYS").MustInt(7)
+ LogInRememberDays = sec.Key("LOGIN_REMEMBER_DAYS").MustInt(31)
SecretKey = loadSecret(sec, "SECRET_KEY_URI", "SECRET_KEY")
if SecretKey == "" {
// FIXME: https://github.com/go-gitea/gitea/issues/16832