caffeine vs session.lifetime about laravel-caffeine

[francislavoie]

I just randomly fell upon this...

The point is that is if the browser is closed, (no pages to the site still open), the user can come back within the 2 hour (default) lifetime to keep using their session. This lib allows that behavior to still work, where if a browser is closed for longer than the lifetime, then the session actually expires. This lib just prevents expiry if a page is still open, so that when the user tries to submit the form, they won't get a CSRF token exception. It tries to guarantee that the form can be worked on for more than the lifetime safely.

[mikebronner]

Hi @garygreen - @francislavoie is right. This package is not intended for secure sites.

• It will only prolong the session on pages that have forms in them.
• it is meant for sites where it is intented for forms not to time out.
• Session WILL expire if the user's computer goes to sleep (the drips seize being sent).
• It is meant to remain secure, as long as the user' computer remains secure (i.e. not in a shared environment or workplace) by not exposing the CSRF token through an API endpoint.
• It differs from setting the session lifetime to a very high value for the above reasons. This is an intentional design, providing a balance between unnecessarily high session lifetimes and insecure forms.