Allow post password cookie expiry to be customized

[Viper007Bond]

It'd be nice if you could customize the expiry time for the post password cookie that is set in wp-login.php?action=postpass.

The only solution right now is ​pretty ugly.

Didn't have time to write a more detailed ticket before now and I didn't want to forget to file this. :)

Someone came up to me at the WCSF Happiness Bar and wanted to make the expiry time on the post password cookies shorter. There's no filter to control the current 10 day value and work arounds are ugly.

A simple filter on the value should do the trick.

time() should be added to the filter arg too, so that it's possible to set a session cookie too, see #21517.

Replying to ocean90:

time() should be added to the filter arg too, so that it's possible to set a session cookie too, see #21517.

Good call.

We should just make the cookie expire at the end of the session. See #21517

Replying to scribu:

We should just make the cookie expire at the end of the session. See #21517

I agree -- much better from a security standpoint, but I also think we should still have a filter for those that prefer a non-session cookie like it is now.

Agreed, considering this feature has been cookie dependent for so long many users may have built their themes/sites around it and cookie mode should then either be deprecated gracefully with backwards compability for a while, or included as a possibility for them in general.

It would still use cookies but rather than expiring after X hours/days, it would expire when the user closed their browser.

So no actual functionality change or removing the cookie, just an expiry change.

Needs a refresh after [21996]. See also comment:2.