Frequent prompts for login when using multiple devices and instances
Summary
My life is a Sisyphean task filled with an endless series of GitLab logins.
Steps to reproduce
I've been using GitLab on two CE instances and one EE instance, the CE instances are: https://gitlab.gnome.org and https://gitlab.freedesktop.org. All instances seem to have the default settings for login expiry (30 days). I use them on 3 different devices (desktop, laptop, phone). The private instance also has Mattermost attached to it.
This means I have 3 * 3 gitlab sessions + 3 mattermost sessions = 12 login sessions running at any given time. Each of these has a separate session timeout, so on average over a month, I have to log into one of these every other day.
Because of this CE bug, I also have to put in a 2FA code every time.
What is the current bug behavior?
ETOOMANYLOGINS, please, I have begun associating interaction with GitLab with login-dread.
What is the expected correct behavior?
One suggestion was that GitLab should reset the cookie expiry every time you use a session so that the expiry is after 30 days of inactivity, not 30 days since login.
You can always expire individual session cookies explicitly in the settings, so that already covers the 'device was stolen' security threat.