title: Is there a security risk when changing the timeout of the session cookie?
body: <p>Suppose I have a pyramid application where I use <code>UnencryptedCookieSessionFactoryConfig</code> for csrf tokens and authentication with <code>SessionAuthenticationPolicy</code>. The default timeout for the session cookie is 1200, which means that my user is disconnect after 20 minutes, which is quite annoying.</p>
  
  <p>I was tempted to raise the timeout or even remove it, and to set a max_age to make it survive the browser, but I guess the timeout is there for a good reason.</p>
  
  <p>Is there a security risk with having an long-lived session cookie ? Is it considered bad practice ?</p>
  
  <p>My guess is that the csrf token should be short-lived. In that case, I should use <code>AuthTktAuthenticationPolicy</code> for the authentication. Same question : is an authentication cookie with a max_age far in the future a bad practice ?</p>