[Zope] Cookies...

[Jules]

On Sun, Feb 06, 2000 at 03:27:16PM +0000, Juri Jensen wrote:
|Is it possible to set some kind of expiration time for users when they
|haven't done anything for a while...?

Juri:

<executive summary>
No.
</executive summary>

</geek answer>
This is an HTTP thing, not a Zope thing. The problem is that the browser
is passing the user's name and password in the HTTP headers each time
you request something from Zope (or indeed any protected resource from
any Web server). So unless you programatically invalidate the password
(bad, as it would confuse the heck out of the user), there's no real
way to have a user 'log out'. The upside of this is that having an idle
user doesn't use any resources on your Web server. When the Zope
Portal Toolkit comes out, I believe it supports the concept of sessions
-- these generally do use server side resources if the client doesn't
support cookies -- and a timeout may be possible with it.
</geek answer>

Good luck!

Cheers,
Jules