Setting session length with Devise

Question

My sessions with devise timeout after 1-3 hours of non-use (not sure exactly how long). How can I adjust this?

I've looked over the docs and can't seem to find a setting for this.

Buseck

Answer 1

Look in config/initializers/devise.rb. There are a lot of configuration settings including config.timeout_in. The default in my version is 30 minutes. You can also set it on the model itself:

class User < ActiveRecord::Base
  devise :timeoutable, :timeout_in => 15.minutes

You can now also set the timeout dynamically.

Dittman

Is it safe to set it to 2 weeks for example? – Sandpaper

Answer 2

With Rails4, the better thing to follow is:

In models/user.rb: Add :timeoutable to already existing list of devise modules.

class User < ActiveRecord::Base
  devise :timeoutable
end

In config/initializers/devise.rb: Set the timeout parameter.

Devise.setup do |config|
  config.timeout_in = 3.hours
end

Mammiemammiferous

Answer 3

Global:

class User < ActiveRecord::Base
  devise (...), :timeoutable
end

Devise.setup do |config|
  config.timeout_in = 3.hours
end

Also it's possible to set timeout_in option dynamically

class User < ActiveRecord::Base
  devise (...), :timeoutable

  def timeout_in
    if self.admin? 
      1.year
    else
      2.days
    end
  end
end

Faultfinder

Yes! Except perhaps you'd want to reverse the times there. Better to make users with more privileges authenticate more frequently... – Fixate