agora inbox for pgsql-www@postgresql.org
help / color / mirror / Atom feedwiki login expiration
7+ messages / 3 participants
[nested] [flat]
* wiki login expiration
@ 2026-09-09 02:47 Noah Misch <noah@leadboat.com>
0 siblings, 1 reply; 7+ messages in thread
From: Noah Misch @ 2026-09-09 02:47 UTC (permalink / raw)
To: pgsql-www
Can we make wiki logins persist for substantially longer? wiki.postgresql.org
appears to require a new click on the "log in" link every hour or so. The
cookie itself has a 30-day expiry, so I gather the server is expiring its side
of the state faster. GPT thinks $wgObjectCacheSessionExpiry is the relevant
mediawiki setting. Perhaps 30d (86400*30) is a reasonable setting?
The new "log in" click usually doesn't require new credential entry, because
the community login cookie is much longer-lived (>1wk). Still, it's an
obstacle. The wiki's behavior of showing cached content to logged-out users
makes this especially important. Visiting the open items page while
logged-out may not show the last many hours of changes.
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: wiki login expiration
@ 2026-09-11 10:28 Álvaro Herrera <alvherre@kurilemu.de>
parent: Noah Misch <noah@leadboat.com>
0 siblings, 1 reply; 7+ messages in thread
From: Álvaro Herrera @ 2026-09-11 10:28 UTC (permalink / raw)
To: Noah Misch <noah@leadboat.com>; +Cc: pgsql-www
On 2026-Sep-08, Noah Misch wrote:
> Can we make wiki logins persist for substantially longer? wiki.postgresql.org
> appears to require a new click on the "log in" link every hour or so. The
> cookie itself has a 30-day expiry, so I gather the server is expiring its side
> of the state faster. GPT thinks $wgObjectCacheSessionExpiry is the relevant
> mediawiki setting. Perhaps 30d (86400*30) is a reasonable setting?
I changed this to 7 days; the documentation
https://www.mediawiki.org/wiki/Manual:$wgObjectCacheSessionExpiry
explains that the logout occurs if you're _inactive_ during that period,
so this should be ergonomic enough for most people, I hope. I'm not
completely sure if the service restart I did is enough for the setting
to take.
One thing that struck me is that our community-auth-initiated sessions
don't apparently have the "keep me logged in" bit set, per the docs for
another related setting [1]. I'm not sure how to set that, but I
suspect that was lost during one of the upgrades. (The code had to be
rewritten from scratch, and pluggable authentication in mediawiki is
somewhat less than excellently documented, so this isn't really
surprising.)
https://www.mediawiki.org/wiki/Manual:$wgExtendedLoginCookieExpiration
Thanks
--
Álvaro Herrera PostgreSQL Developer — https://www.EnterpriseDB.com/
"Ninguna manada de bestias tiene una voz tan horrible como la humana" (Orual)
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: wiki login expiration
@ 2026-09-11 18:35 Noah Misch <noah@leadboat.com>
parent: Álvaro Herrera <alvherre@kurilemu.de>
0 siblings, 1 reply; 7+ messages in thread
From: Noah Misch @ 2026-09-11 18:35 UTC (permalink / raw)
To: Álvaro Herrera <alvherre@kurilemu.de>; +Cc: pgsql-www
On Fri, Sep 11, 2026 at 12:28:32PM +0200, Álvaro Herrera wrote:
> On 2026-Sep-08, Noah Misch wrote:
> > Can we make wiki logins persist for substantially longer? wiki.postgresql.org
> > appears to require a new click on the "log in" link every hour or so. The
> > cookie itself has a 30-day expiry, so I gather the server is expiring its side
> > of the state faster. GPT thinks $wgObjectCacheSessionExpiry is the relevant
> > mediawiki setting. Perhaps 30d (86400*30) is a reasonable setting?
>
> I changed this to 7 days; the documentation
> https://www.mediawiki.org/wiki/Manual:$wgObjectCacheSessionExpiry
> explains that the logout occurs if you're _inactive_ during that period,
> so this should be ergonomic enough for most people, I hope. I'm not
> completely sure if the service restart I did is enough for the setting
> to take.
Thanks. Since your email, I've had the wiki login expire twice more in the
same browser, so I don't think the change has taken effect yet.
I agree logout after 7d inactive is plenty generous.
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: wiki login expiration
@ 2026-09-14 06:07 Magnus Hagander <magnus@hagander.net>
parent: Noah Misch <noah@leadboat.com>
0 siblings, 1 reply; 7+ messages in thread
From: Magnus Hagander @ 2026-09-14 06:07 UTC (permalink / raw)
To: Noah Misch <noah@leadboat.com>; +Cc: Álvaro Herrera <alvherre@kurilemu.de>; pgsql-www
On Fri, 11 Sept 2026 at 20:35, Noah Misch <noah@leadboat.com> wrote:
> On Fri, Sep 11, 2026 at 12:28:32PM +0200, Álvaro Herrera wrote:
> > On 2026-Sep-08, Noah Misch wrote:
> > > Can we make wiki logins persist for substantially longer?
> wiki.postgresql.org
> > > appears to require a new click on the "log in" link every hour or so.
> The
> > > cookie itself has a 30-day expiry, so I gather the server is expiring
> its side
> > > of the state faster. GPT thinks $wgObjectCacheSessionExpiry is the
> relevant
> > > mediawiki setting. Perhaps 30d (86400*30) is a reasonable setting?
> >
> > I changed this to 7 days; the documentation
> > https://www.mediawiki.org/wiki/Manual:$wgObjectCacheSessionExpiry
> > explains that the logout occurs if you're _inactive_ during that period,
> > so this should be ergonomic enough for most people, I hope. I'm not
> > completely sure if the service restart I did is enough for the setting
> > to take.
>
> Thanks. Since your email, I've had the wiki login expire twice more in the
> same browser, so I don't think the change has taken effect yet.
>
I *think* it looks like the change was reverted. Alvaro - is that something
you did intentionally, or did you forget to update the repo? :)
--
Magnus Hagander
Me: https://www.hagander.net/ <http://www.hagander.net/;
Work: https://www.redpill-linpro.com/ <http://www.redpill-linpro.com/;
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: wiki login expiration
@ 2026-09-14 18:06 Álvaro Herrera <alvherre@kurilemu.de>
parent: Magnus Hagander <magnus@hagander.net>
0 siblings, 1 reply; 7+ messages in thread
From: Álvaro Herrera @ 2026-09-14 18:06 UTC (permalink / raw)
To: Magnus Hagander <magnus@hagander.net>; +Cc: Noah Misch <noah@leadboat.com>; pgsql-www
On 2026-Sep-14, Magnus Hagander wrote:
> I *think* it looks like the change was reverted. Alvaro - is that something
> you did intentionally, or did you forget to update the repo? :)
Meh, I was looking for the LocalSettings.php file in the wrong place in
the wrapper package. Should be fixed for real now.
--
Álvaro Herrera PostgreSQL Developer — https://www.EnterpriseDB.com/
"Ninguna manada de bestias tiene una voz tan horrible como la humana" (Orual)
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: wiki login expiration
@ 2026-09-14 22:46 Noah Misch <noah@leadboat.com>
parent: Álvaro Herrera <alvherre@kurilemu.de>
0 siblings, 1 reply; 7+ messages in thread
From: Noah Misch @ 2026-09-14 22:46 UTC (permalink / raw)
To: Álvaro Herrera <alvherre@kurilemu.de>; +Cc: Magnus Hagander <magnus@hagander.net>; pgsql-www
On Mon, Sep 14, 2026 at 08:06:14PM +0200, Álvaro Herrera wrote:
> On 2026-Sep-14, Magnus Hagander wrote:
> > I *think* it looks like the change was reverted. Alvaro - is that something
> > you did intentionally, or did you forget to update the repo? :)
>
> Meh, I was looking for the LocalSettings.php file in the wrong place in
> the wrapper package. Should be fixed for real now.
Thanks. Since this email, I've again had the wiki login expire twice in the
same browser.
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: wiki login expiration
@ 2026-09-15 13:11 Noah Misch <noah@leadboat.com>
parent: Noah Misch <noah@leadboat.com>
0 siblings, 0 replies; 7+ messages in thread
From: Noah Misch @ 2026-09-15 13:11 UTC (permalink / raw)
To: Álvaro Herrera <alvherre@kurilemu.de>; +Cc: Magnus Hagander <magnus@hagander.net>; pgsql-www
On Mon, Sep 14, 2026 at 03:46:49PM -0700, Noah Misch wrote:
> On Mon, Sep 14, 2026 at 08:06:14PM +0200, Álvaro Herrera wrote:
> > On 2026-Sep-14, Magnus Hagander wrote:
> > > I *think* it looks like the change was reverted. Alvaro - is that something
> > > you did intentionally, or did you forget to update the repo? :)
> >
> > Meh, I was looking for the LocalSettings.php file in the wrong place in
> > the wrapper package. Should be fixed for real now.
>
> Thanks. Since this email, I've again had the wiki login expire twice in the
> same browser.
Update: the last few sessions have lasted. I think the change is taking
effect. Excellent.
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2026-09-15 13:11 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-09-09 02:47 wiki login expiration Noah Misch <noah@leadboat.com>
2026-09-11 10:28 ` Álvaro Herrera <alvherre@kurilemu.de>
2026-09-11 18:35 ` Noah Misch <noah@leadboat.com>
2026-09-14 06:07 ` Magnus Hagander <magnus@hagander.net>
2026-09-14 18:06 ` Álvaro Herrera <alvherre@kurilemu.de>
2026-09-14 22:46 ` Noah Misch <noah@leadboat.com>
2026-09-15 13:11 ` Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox