diff options
| author | Tim Graham <timograham@gmail.com> | 2013-11-30 08:37:15 -0500 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2013-11-30 08:37:15 -0500 |
| commit | f3e7ab366c597571198dc8d024f09e619991bac4 (patch) | |
| tree | a7770e906f81bc2e7e37e64d849a9092d706f11b /docs/topics/http | |
| parent | c0a2daad78c66def2ce6592977b78dab6475dd53 (diff) | |
Removed gender-based pronouns per [c0a2daad78].
Diffstat (limited to 'docs/topics/http')
| -rw-r--r-- | docs/topics/http/sessions.txt | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/docs/topics/http/sessions.txt b/docs/topics/http/sessions.txt index d39b8344c6..f7e8807945 100644 --- a/docs/topics/http/sessions.txt +++ b/docs/topics/http/sessions.txt @@ -166,7 +166,7 @@ and the :setting:`SECRET_KEY` setting. cookie backend might open you up to `replay attacks`_. Unlike other session backends which keep a server-side record of each session and invalidate it when a user logs out, cookie-based sessions are not invalidated when a user - logs out. Thus if an attacker steals a user's cookie, he or she can use that + logs out. Thus if an attacker steals a user's cookie, they can use that cookie to login as that user even if the user logs out. Cookies will only be detected as 'stale' if they are older than your :setting:`SESSION_COOKIE_AGE`. @@ -590,8 +590,8 @@ log in every time they open a browser. If :setting:`SESSION_EXPIRE_AT_BROWSER_CLOSE` is set to ``True``, Django will use browser-length cookies -- cookies that expire as soon as the user closes -his or her browser. Use this if you want people to have to log in every time -they open a browser. +their browser. Use this if you want people to have to log in every time they +open a browser. This setting is a global default and can be overwritten at a per-session level by explicitly calling the :meth:`~backends.base.SessionBase.set_expiry` method |