WebUI: add session cookie expiration date based on session timeout

[rioradio]

Closes #20993

WebUI: add session cookie expiration date based on session timeout

[Chocobo1]

What about this comment? #20993 (comment)

[rioradio]

My pull request allows me to stay logged in to the qBittorrent WebUI without the browser restoring my session.
This is how it should be.
For example, if I visit the WebUI once a week and the session timeout is set to 7,776,000 seconds (90 days), and I don't want to login every time.

[Chocobo1]

This is wrong. In your PR, the cookie is always going to expire when the time is up.
However, we want the cookie to not expire as long as the user is still using the webapi/webui.

I would suggest something like this:

Suggested change

	cookie.setExpirationDate(QDateTime::currentDateTime().addSecs(m_sessionTimeout));
	cookie.setExpirationDate(QDateTime::fromSecsSinceEpoch(std::numeric_limits<qint64>::max()));

AFAIK, Chrome and Firefox clamps max time to about 1 year. But Safari will only clamp to 7 days.

[rioradio]

We have WebUI Session Timeout in seconds in m_sessionTimeout. Why do you want to use a different value?

[Chocobo1]

m_sessionTimeout is a value for session timeout (as long as user keep using it, it won't time out). It is not a time limit for expiring a cookie. You don't need to insist using it for cookie expiration date.
You should look around and see how m_sessionTimeout is actually used.

[rioradio]

However, we want the cookie to not expire as long as the user is still using the webapi/webui.

Maybe it would be better to replace the cookie with a new session expiration date each time the user accesses the WebUI?

[Chocobo1]

Maybe it would be better to replace the cookie with a new session expiration date each time the user accesses the WebUI?

Yes, that is the basic idea. Chrome also suggests it: https://developer.chrome.com/blog/cookie-max-age-expires#extending_cookie_expiration
It seems in order to achieve this goal it will require a bit more code refactor. I suppose I could handle it unless you beats me to it.

[rioradio]

Something like this?

rioradio@0fd54b0

[Chocobo1]

Something like this?
rioradio@0fd54b0

Close. I'm thinking something like #23392.