Repository: paperless-ngx/paperless-ngx

Issue:
[BUG] No age set for sessionid cookie
### Description

I noticed that I have to log in to paperless every time I reopen my browser and this is annoying. So I took a look at the documentation of paperless and django. I found the django setting `SESSION_COOKIE_AGE` that is set to 2 weeks by default. Paperless doesn't change this setting so the cookie age should be 2 weeks but if you send  a request to `/accounts/login` the server sends you the sessionid without a cookie age. (The browser will delete the cookie after the session)

### Steps to reproduce

1. Login using the ui or send a request manually to `/accounts/login/`
2. Take a look to the `Set-Cookie` header for the `sessionid`

### Webserver logs

```bash
There are no webserver logs related to this issue.
```


### Browser logs

_No response_

### Paperless-ngx version

2.6.2

### Host OS

ghcr.io paperless docker on ubuntu 22 x86_64

### Installation method

Docker - official image

### Browser

Chrome

### Configuration changes

_No response_

### Other

_No response_

### Please confirm the following

- [X] I believe this issue is a bug that affects all users of Paperless-ngx, not something specific to my installation.
- [X] I have already searched for relevant existing issues and discussions before opening this report.
- [X] I have updated the title field above with a concise description.


Discussion:
This is a feature (change) request. It’s also been this way for literally years.
It is new behaviour since 2.5.x version. Everytime is a re-login needed after a very short amount of time after you have closed the Paperless tab. Maybe not a bug but in a private use case this is annoying.

Is there a setting which I can change to make it last 2 weeks again?
Perhaps adding allauth changed things, but Im also not seeing it.

<img width="1652" alt="Screenshot 2024-03-13 at 7 19 57 AM" src="https://github.com/paperless-ngx/paperless-ngx/assets/4887959/08fdd661-33a5-4723-9d91-0ba387f58388">

There are no paperless settings for it, which is why this would be a FR if needed
> This is a feature (change) request. It’s also been this way for literally years.

Tbh, I think, this is just false. I feel also affected and dug into it a little bit. I hope these findings will let you reopen this issue.

TL;DR: the changes around allauth introduced in 2.5.0 changed the sessionid cookie. This can be changed/fixed using an allauth configuration setting.

Since version 2.5.0 the sessionid cookie is clearly set without an end-date and thus gets a so called "session cookie" (not about a session in a web app, but a browser session; terrible naming 🤣). You can clearly see this in ![grafik](https://github.com/paperless-ngx/paperless-ngx/assets/85439599/d8497cb2-700d-4400-8dc7-f8d59bf85969)

For reference, this is how it looked like in 2.4.3 (and before):
![grafik](https://github.com/paperless-ngx/paperless-ngx/assets/85439599/729fdd51-e622-4528-acd9-bc0d37f86da2)

I'm not sure, why this is not for you, @shamoon, but I can clearly see this difference. Did you relogin? In my tests I was sometimes confused, when I did not logout and login again with the new version.

I went a step further and confirmed it to be connected to the allauth change: https://docs.allauth.org/en/latest/account/configuration.html references a ``ACCOUNT_SESSION_REMEMBER`` setting and if I set this to ``True``, even newer Paperless versions (tested in 2.5.0) set the cookie with an end date. So I see this as a regression introduced by the changes around allauth, as this change is not documented and (according to the above quote) not wanted. Imho, either the ``ACCOUNT_SESSION_REMEMBER`` should be set to true, there should be a paperless config for this or a checkbox on login. At the very least, the change has to be documented.
Furthermore, see #5623 (opened shortly before the release of 2.5.0) which asks for the change observed by this bug report as a FR. This is a further clear indication of the behavior pre-2.5.0. Post-2.5.0 behavior is reported by three people now, as said I'm not sure why this is not for you @shamoon, but I hope it is worth further investigation by you.
> but Im also not seeing it

I just looked at the image @shamoon again and one can see a ``authelia_session`` cookie in there. Maybe this relates to your problem of reproducing this issue?

Resolving patch:
diff --git a/src/paperless/settings.py b/src/paperless/settings.py
--- a/src/paperless/settings.py
+++ b/src/paperless/settings.py
@@ -456,6 +456,8 @@ def _parse_base_paths() -> tuple[str, str, str, str, str]:
     "optional",
 )
 
+ACCOUNT_SESSION_REMEMBER = __get_boolean("PAPERLESS_ACCOUNT_SESSION_REMEMBER")
+
 if AUTO_LOGIN_USERNAME:
     _index = MIDDLEWARE.index("django.contrib.auth.middleware.AuthenticationMiddleware")
     # This overrides everything the auth middleware is doing but still allows


Test patch: