{"action":"opened","issue":{"url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/59","labels_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/59/labels{/name}","comments_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/59/comments","events_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/59/events","html_url":"https://github.com/hapijs/hapi-auth-cookie/issues/59","id":64612139,"number":59,"title":"Unable to set cookie to browser session","user":{"login":"briandela","id":1672480,"avatar_url":"https://avatars.githubusercontent.com/u/1672480?v=3","gravatar_id":"","url":"https://api.github.com/users/briandela","html_url":"https://github.com/briandela","followers_url":"https://api.github.com/users/briandela/followers","following_url":"https://api.github.com/users/briandela/following{/other_user}","gists_url":"https://api.github.com/users/briandela/gists{/gist_id}","starred_url":"https://api.github.com/users/briandela/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/briandela/subscriptions","organizations_url":"https://api.github.com/users/briandela/orgs","repos_url":"https://api.github.com/users/briandela/repos","events_url":"https://api.github.com/users/briandela/events{/privacy}","received_events_url":"https://api.github.com/users/briandela/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-26T19:19:37Z","updated_at":"2015-03-26T19:19:37Z","closed_at":null,"body":"We have a default hapi-auth-cookie expiration of 2 weeks. However, for some users we want to allow them to set the auth cookie to be browser session only (e.g. unchecking a `remember me` checkbox on the login form).\r\n\r\ne.g. plugin config\r\n```js\r\noptions: {\r\n    password: process.env.AUTH_COOKIE_PWD,\r\n    ttl: moment.duration(2, 'weeks').asMilliseconds(),\r\n    domain: process.env.AUTH_COOKIE_DOMAIN,\r\n    redirectUrl: '/login'\r\n}\r\n```\r\n\r\nDuring the request we have something like this:\r\n\r\n```js\r\nif(!remember) {\r\n    request.auth.session.ttl(null);\r\n}\r\n```\r\n\r\nHowever, this will still result in the ttl being set to `moment.duration(2, 'weeks').asMilliseconds(),`. It looks like `statehood` will always take the base options when the ttl is set to null: `var definition = cookie.options ? Hoek.applyToDefaults(base, cookie.options) : base;`\r\n\r\nThis makes sense from the `statehood` perspective, but from the `hapi-auth-cookie` perspective my expectation as a user would be that calling `request.auth.session.ttl()` would override the ttl set in default options - this only appears to be the case some of the time.\r\n\r\nWe can work around this be defaulting everything to browser session and inverting our logic to explicitly set the ttl using this following:\r\n\r\n```js\r\nif(remember === true) {\r\n    request.auth.session.ttl(moment.duration(2, 'weeks').asMilliseconds());\r\n}\r\n```\r\n\r\nHowever, this now means our main-line scenario (people leaving the box checked) has it's ttl separated from the hapi-auth-cookie plugin config.\r\n\r\nWanted to open this issue to see if there is a solution to have `request.auth.session.ttl(null);` work or if the `hapi-auth-cookie` docs should be updated to point out this scenario.\r\n"}}