datasette-auth-github 1.0 swaps browser-session cookies for 30-day logins

Simon Willison has released datasette-auth-github 1.0, a Datasette plugin that authenticates users via GitHub. The headline change is small but instructive: the plugin no longer sets browser-session cookies. According to the release notes, cookies now last login_max_age seconds, and that value defaults to 30 days.

What changed

Willison runs the plugin on the agent.datasette.io demo site and noticed that his authenticated sessions were not lasting long. The plugin was setting cookies without a Max-Age parameter, so they expired at the end of the browser session. In his words, that seems to happen pretty often in Mobile Safari, independently of how you are using the app. The fix is tracked as #80, whose title is "Uses browser session cookies which log user out too often".

• Before: login cookies had no Max-Age, so they lasted only as long as the browser session.
• After: cookies last login_max_age seconds, defaulting to 30 days (2,592,000 seconds).
• Compatibility: the plugin is tested against Datasette 0.65.x and Datasette 1.0ax. Given its age, Willison declared it 1.0 as part of an effort to "get better at promoting stable plugins to 1.0".

The release notes list this cookie change as the only entry.

Why session lifetime is a security decision

This looks like a pure convenience fix, and for the reported bug it is. But cookie lifetime also decides how long a credential stays useful. With no Max-Age, the browser decides when the session ends. With an explicit value, the application decides, and the default here is 30 days.

That has practical consequences. A cookie taken from a lost phone, a shared machine or a compromised browser profile stays usable for longer than before. Whether that is acceptable depends on what the Datasette instance exposes and on how the plugin validates the cookie. The release notes and the original post do not cover that, so read the plugin's code and documentation rather than assuming.

What to do if you run it

1. 1Choose a lifetime on purpose. If the instance exposes anything sensitive, set login_max_age below the 30-day default instead of inheriting it.
2. 2Expect behaviour to change on upgrade. Users who were previously logged out at the end of each browser session will now stay logged in until the configured lifetime ends.
3. 3Test before rolling out. Version 1.0 is tested against Datasette 0.65.x and 1.0ax, so confirm your own version and configuration in a staging copy first.
4. 4Audit your other apps. Check what expiry attributes your own session cookies set (Max-Age or Expires), and whether that lifetime is a documented decision.

Reading the 1.0 label correctly

A 1.0 tag signals that a maintainer considers the plugin stable and is willing to keep its interface steady. Nothing in the sources suggests a security review accompanied it. For teams that gate access to data behind GitHub login, the sensible response is to treat the release like any other dependency change: read the changelog, look at what defaults moved, and decide whether they still match your risk appetite.