Ticket #1406: turbogears_visit_cookie_timeout.patch

turbogears/visit/api.py

@@ -3 +3 @@
 import threading
 from random import random
 from datetime import timedelta, datetime
+import time
 
 import cherrypy
 import pkg_resources
@@ -125 +126 @@
         self.cookie_secure= get( "visit.cookie.secure", False )
         # By default, I don't specify the cookie domain.
         self.cookie_domain= get( "visit.cookie.domain", None )
+        self.cookie_max_age = int(get( "visit.timeout", "20")) * 60
         assert self.cookie_domain!="localhost", \
                "localhost is not a valid value for visit.cookie.domain. Try None instead."
 
@@ -194 +196 @@
         cookies= cherrypy.response.simple_cookie
         cookies[self.cookie_name]= visit_key
         cookies[self.cookie_name]['path']= self.cookie_path
+        # We'd like to use the "max-age" param as
+        #   http://www.faqs.org/rfcs/rfc2109.html indicates but IE doesn't
+        #   save it to disk and the session is lost if people close
+        #   the browser
+        #   So we have to use the old "expires" ... sigh ...
+        #cookies[self.cookie_name]['max-age']= self.cookie_max_age
+        gmt_expiration_time = time.gmtime(time.time() + self.cookie_max_age)
+        cookies[self.cookie_name]['expires'] = time.strftime(
+                        "%a, %d-%b-%Y %H:%M:%S GMT", gmt_expiration_time)
         if self.cookie_secure:
             cookies[self.cookie_name]['secure']= True
         if self.cookie_domain: