Several users reported again and again that users are logged out when they close their browser window. After upgrading to 4.5.0, I also noticed this, and found out that some explicit cookie setting code in user.module causes this behaviour. That cookie setting clearly shows that a session cookie is to be set, and it overwrites the properly timed cookie set by the PHP session module.
Watching my cookies closely (deciding on them one by one), showed that the originally set proper cookie is overwritten with a session cookie, which expires on browser close. This overwrite takes place on the lines, which I am about to suggest to remove. I don't see the use of that cookie setting anyway in that context, since there is a proper cookie already set by the PHP session module at that time anyway.
BTW I also realized that drupal.org tries to set my cookie on every page, keeping the expire interval safe (always setting the expiry time later as time passes with every request). My 4.5 site does not do this however...
Comments
Comment #1
gábor hojtsyAnd yep, it also applies to 4.5.0
Comment #2
dries commentedCommitted to the HEAD and the DRUPAL-4-5 branch.
Comment #3
(not verified) commented