title: How do I disable automatic session expiry update in Django?
body: <p>I'm developing an application in Django with some specific security requirements. One of them is to disable the default behaviour to automatically extend the expiry of sessions on activity. Yes, I want to sessions to expire unless explicitly renewed (e.g. re-login, renew token, etc. - not relevant right now).</p>
  
  <p>How is this improving security? Well, a malicious user taking control over the PC of the victim will then only have access to the application with the victim authenticated for only a limited time.</p>
  
  <p>Unfortunately, using <a href="https://docs.djangoproject.com/en/1.5/topics/http/sessions/" rel="nofollow noreferrer"><code>django.contrib.sessions</code></a>, this seems not configurable as the <em>modification</em> time of the session is being used thoroughly and in the very base of the backends (<code>backends/base.py</code>) for the server-side storage as well as in the middleware component (<code>middleware.py</code>) for the HTTP cookie. Also, the expiry is only accessible in the relative form to the modification time internally (<code>SessionStore._session_expiry</code>) as only the session <em>data</em> is being loaded into the session object. So, unless we ask the model directly (<code>Session.objects.get(pk=s.session_key).expire_date</code> - ugh, ugly), we don't know what the expire date is.</p>
  
  <p>How do I implement this properly? Is this possible without reimplementing the methods <code>get_expiry_*</code> and the <code>process_response()</code> middleware function? I'd rather avoid that as I think it might break a later time in case Django gets updated.</p>
  
  <p>Trying that out by setting a custom session variable to keep track of the expiry in my own terms (like in <a href="https://stackoverflow.com/a/3025372/1254292">this answer</a>) seems not only redundant, but it also confuses other apps/code asking <code>SessionStore.get_expiry_age()</code> while my middleware would enforce a different expiry. Therefore, I'm considering this approach to be too low in quality for my purposes.</p>
  
  <p>Am I right in my assumptions above? Should I request this as a new feature and patch it myself in the meantime?</p>