<p>You're probably looking for the <a href="https://craftcms.com/docs/config-settings#userSessionDuration" rel="nofollow noreferrer"><code>userSessionDuration</code></a> config setting where you can adjust the length of time an authenticated Craft session should have (or just have it session/browser based).</p>

<p>Other related session config settings you might be interested in:</p>

<p><a href="https://craftcms.com/docs/config-settings#elevatedSessionDuration" rel="nofollow noreferrer">https://craftcms.com/docs/config-settings#elevatedSessionDuration</a></p>

<p><a href="https://craftcms.com/docs/config-settings#rememberedUserSessionDuration" rel="nofollow noreferrer">https://craftcms.com/docs/config-settings#rememberedUserSessionDuration</a></p>

CC BY-SA 3.0
2017-03-06T22:21:03.927Z
Follow up question: I see how userSessionDuration works.  Is there a way to have that value and then also a setting that kills the session immediately when the browser is closed?
Chip Shank
CC BY-SA 3.0
2017-03-06T23:20:28.883Z
From the docs: "Set to false if you want users to stay logged in as long as their browser is open rather than a predetermined amount of time."
Brad Bell
CC BY-SA 3.0
2017-03-07T15:57:21.877Z
Thanks.  I did do that and it works ok.  I was also hoping there was something that would create a session 'timeout' even if the browser stays open and at the same time, the session would immediately be 'killed' if the browser is closed.  Thanks again.
Chip Shank
CC BY-SA 3.0
2017-03-04T00:09:20.280Z
2017-03-04T00:09:20.280Z
Brad Bell
<p>I am coming from a .NET/C# authentication and session environment.  I have used <code>{% requireLogin %}</code> to create a secure area on the front-end of my website, but it seems that the login credential (or cookie) stays persistent after the browser is closed.  There does seem to be time factor as the next day a login is required, but the same day after a somewhat short period with the browser being closed I can relaunch the browser and I have full access to the secure areas and the system knows my user account, etc...</p>

<p>Looking for some direction to explain the Craft security and cookie lifespan in more detail.</p>

<login>
Looking for a good explanation on Craft login and if it is using persistent cookies or session cookies, etc...?
# Looking for a good explanation on Craft login and if it is using persistent cookies or session cookies, etc...?

(Asked by: username_0 on 2017-03-03)

I am coming from a .NET/C# authentication and session environment. I have used `{% requireLogin %}` to create a secure area on the front-end of my website, but it seems that the login credential (or cookie) stays persistent after the browser is closed. There does seem to be time factor as the next day a login is required, but the same day after a somewhat short period with the browser being closed I can relaunch the browser and I have full access to the secure areas and the system knows my user account, etc...

Looking for some direction to explain the Craft security and cookie lifespan in more detail.

**Tags:** login

---

## 1 answers

### Answer by username_1 on 2017-03-04. Score: 0 | Accepted answer

You're probably looking for the [`userSessionDuration`](https://craftcms.com/docs/config-settings#userSessionDuration) config setting where you can adjust the length of time an authenticated Craft session should have (or just have it session/browser based).

Other related session config settings you might be interested in:

<https://craftcms.com/docs/config-settings#elevatedSessionDuration>

<https://craftcms.com/docs/config-settings#rememberedUserSessionDuration>

> **Comments:**
> **username_0**: Follow up question: I see how userSessionDuration works.  Is there a way to have that value and then also a setting that kills the session immediately when the browser is closed?  
> **username_1**: From the docs: "Set to false if you want users to stay logged in as long as their browser is open rather than a predetermined amount of time."  
> **username_0**: Thanks.  I did do that and it works ok.  I was also hoping there was something that would create a session 'timeout' even if the browser stays open and at the same time, the session would immediately be 'killed' if the browser is closed.  Thanks again.  

---

