Why doesn't SESSION_EXPIRE_AT_BROWSER_CLOSE = True log the user out when the browser is closed?

Question

According to Django documentation, "if SESSION_EXPIRE_AT_BROWSER_CLOSE is set to True, Django will use browser-length cookies -- cookies that expire as soon as the user closes his or her browser. Use this if you want people to have to log in every time they open a browser."

And that is what I did by adding the following line to my settings.py file (and restarting the server):

# Close the session when user closes the browser
SESSION_EXPIRE_AT_BROWSER_CLOSE = True

Then I logged into a page which checks if the user is authenticated, and then I closed the browser. When I open my browser again and visit the same page it does not ask for a username and a password because it passes the following test apparently:

def check_teacher(request):
    result = {}
    if request.user.is_authenticated():
        ...

What am I doing wrong or what am I missing? Any suggestions?

I'm using Django version 1.3 pre-alpha SVN-13858 on my Ubuntu GNU/Linux 10.10 system and running the above example using the Django development server.

Answer 1

@istruble and @haasfsafas are both correct. The solution is to

1. Set SESSION_EXPIRE_AT_BROWSER_CLOSE = True
2. Delete the rows in the django_session table to clear out any sessions that might cause confusion. (delete from django_session)
3. Recognize that all of the windows and tabs in your browser must be closed in order for the session to expire. That's browser behavior; not Django behavior.

Answer 2

The change will not apply unless you run the manage.py syncdb again.

Answer 3

You have to cleanup the sessions in DB:

delete FROM django_session

Answer 4

For anyone who still doesn't fix the issue after trying all the above solutions, here is one more.

Add this SESSION_ENGINE = 'django.contrib.sessions.backends.cache' along with the SESSION_EXPIRE_AT_BROWSER_CLOSE = True

It works out for me, good luck folks.