@@ -45,7 +45,7 @@ Now you can start Datasette like this, passing in the secrets as environment var
 
 Note that hard-coding secrets in `metadata.json` is a bad idea as they will be visible to anyone who can navigate to `/-/metadata`. Instead, we use Datasette's mechanism for [adding secret plugin configuration options](https://docs.datasette.io/en/stable/plugins.html#secret-configuration-values).
 
-By default anonymous users will still be able to interact with Datasette. If you wish all users to have to sign in with a GitHub account first, add this to your ``metadata.json``:
+By default anonymous users will still be able to interact with Datasette. If you wish all users to have to sign in with a GitHub account first, add this to your Datasette configuration:
 
 ```json
 {
@@ -59,6 +59,21 @@ By default anonymous users will still be able to interact with Datasette. If you
     }
 }
 ```
+
+By default, signing in creates a cookie that stays valid for **30 days**. Set `login_max_age` to a positive integer number of seconds to change that login duration. For 24 hours, use 24 * 60 * 60 = 86400:
+
+```json
+{
+    "plugins": {
+        "datasette-auth-github": {
+            "client_id": {"$env": "GITHUB_CLIENT_ID"},
+            "client_secret": {"$env": "GITHUB_CLIENT_SECRET"},
+            "login_max_age": 86400
+        }
+    }
+}
+```
+
 ## The authenticated actor
 
 Visit `/-/actor` when signed in to see the shape of the authenticated actor. It should look something like this:
@@ -159,7 +174,7 @@ If your organization is [arranged into teams](https://help.github.com/en/article
 
 A user's organization and team memberships are checked once, when they first sign in. Those teams and organizations are then persisted in the user's signed `ds_actor` cookie.
 
-This means that if a user is removed from an organization or team but still has a Datasette cookie, they will still be able to access that Datasette instance.
+This means that if a user is removed from an organization or team but still has a valid Datasette cookie, they will still be able to access that Datasette instance until the cookie expires or is invalidated. The default expiration is 30 days after sign-in.
 
 You can remedy this by rotating the `DATASETTE_SECRET` environment variable any time you make changes to your GitHub organization members.
 
 
@@ -1,17 +1,24 @@
 from datasette.utils.asgi import Response
+from datasette.utils import baseconv
 from urllib.parse import parse_qsl
 from .utils import load_orgs_and_teams
 import httpx
-
+import time
 
 DEPRECATED_KEYS = ("allow_users", "allow_orgs", "allow_teams")
+DEFAULT_LOGIN_MAX_AGE = 30 * 24 * 60 * 60
 
 
 def verify_config(config):
     config = config or {}
     for key in DEPRECATED_KEYS:
         assert key not in config, "{} is no longer a supported option".format(key)
     config.setdefault("host", "github.com")
+    login_max_age = config.get("login_max_age", DEFAULT_LOGIN_MAX_AGE)
+    if login_max_age is not None and (
+        type(login_max_age) is not int or login_max_age <= 0
+    ):
+        raise ValueError("login_max_age must be a positive integer or null")
 
 
 async def github_auth_start(datasette):
@@ -87,5 +94,18 @@ async def github_auth_callback(datasette, request, scope, receive, send):
 
     # Set a signed cookie and redirect to homepage (respecting 'base_url' setting)
     response = Response.redirect(datasette.urls.path("/"))
-    response.set_cookie("ds_actor", datasette.sign({"a": actor}, "actor"))
+    login_max_age = config.get("login_max_age", DEFAULT_LOGIN_MAX_AGE)
+    data = {"a": actor}
+    if login_max_age is not None:
+        # Enforce expiration server-side as well as in the browser.
+        data["e"] = baseconv.base62.encode(int(time.time()) + login_max_age)
+    response.set_cookie(
+        "ds_actor",
+        datasette.sign(data, "actor"),
+        max_age=login_max_age,
+        httponly=True,
+        secure=request.scheme == "https",
+        samesite="lax",
+        path="/",
+    )
     return response
@@ -1,10 +1,22 @@
 from datasette.app import Datasette
+from datasette.utils import baseconv
+from datasette_auth_github.views import verify_config
+from http.cookies import SimpleCookie
+import inspect
 import pytest
 import pytest_asyncio
 import sqlite_utils
 import re
 
 
+def datasette_with_config(files=None, config=None, **kwargs):
+    # Datasette 1.0 moved plugin and permission configuration out of metadata.
+    config_key = (
+        "config" if "config" in inspect.signature(Datasette).parameters else "metadata"
+    )
+    return Datasette(files, **{config_key: config}, **kwargs)
+
+
 @pytest.fixture
 def non_mocked_hosts():
     return ["localhost"]
@@ -98,9 +110,9 @@ def mocked_github_api(httpx_mock):
 async def ds(tmpdir):
     filepath = str(tmpdir / "test.db")
     filepath2 = str(tmpdir / "demouser_org_only.db")
-    ds = Datasette(
+    ds = datasette_with_config(
         [filepath, filepath2],
-        metadata={
+        config={
             "plugins": {
                 "datasette-auth-github": {
                     "client_id": "x_client_id",
@@ -167,6 +179,115 @@ async def test_github_auth_callback(ds, mocked_github_api):
     assert "/" == response.headers["location"]
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "scheme,force_https_urls,expected_secure",
+    [("http", False, False), ("https", False, True), ("http", True, True)],
+    ids=["http", "https", "https-proxy"],
+)
+@pytest.mark.parametrize(
+    "cookie_config,expected_max_age",
+    [({}, 2592000), ({"login_max_age": 3600}, 3600), ({"login_max_age": None}, None)],
+    ids=["default", "custom", "session-only"],
+)
+async def test_callback_cookie_attributes(
+    mocked_github_api,
+    monkeypatch,
+    scheme,
+    force_https_urls,
+    expected_secure,
+    cookie_config,
+    expected_max_age,
+):
+    now = 1700000000
+    monkeypatch.setattr("time.time", lambda: now)
+    ds = datasette_with_config(
+        config={
+            "plugins": {
+                "datasette-auth-github": {
+                    "client_id": "x_client_id",
+                    "client_secret": "x_client_secret",
+                    **cookie_config,
+                }
+            }
+        },
+        settings={"force_https_urls": force_https_urls},
+    )
+    response = await ds.client.request(
+        "GET",
+        f"{scheme}://localhost/-/github-auth-callback?code=github-code-here",
+        follow_redirects=False,
+        avoid_path_rewrites=True,
+    )
+    assert response.status_code == 302
+    cookies = SimpleCookie()
+    for header in response.headers.get_list("set-cookie"):
+        cookies.load(header)
+    cookie = cookies["ds_actor"]
+    assert cookie["httponly"] is True
+    assert bool(cookie["secure"]) is expected_secure
+    assert cookie["samesite"].lower() == "lax"
+    assert cookie["path"] == "/"
+    assert cookie["domain"] == ""
+    payload = ds.unsign(cookie.value, "actor")
+    assert payload["a"]["id"] == "github:123"
+    if expected_max_age is None:
+        assert cookie["max-age"] == ""
+        assert cookie["expires"] == ""
+        assert "e" not in payload
+    else:
+        assert cookie["max-age"] == str(expected_max_age)
+        assert int(baseconv.base62.decode(payload["e"])) == now + expected_max_age
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "cookie_config,max_age",
+    [({}, 2592000), ({"login_max_age": 3600}, 3600), ({"login_max_age": None}, None)],
+    ids=["default", "custom", "session-only"],
+)
+async def test_callback_cookie_expiration(
+    mocked_github_api, monkeypatch, cookie_config, max_age
+):
+    now = 1700000000
+    monkeypatch.setattr("time.time", lambda: now)
+    ds = datasette_with_config(
+        config={
+            "plugins": {
+                "datasette-auth-github": {
+                    "client_id": "x_client_id",
+                    "client_secret": "x_client_secret",
+                    **cookie_config,
+                }
+            }
+        }
+    )
+    response = await ds.client.get(
+        "/-/github-auth-callback?code=github-code-here", follow_redirects=False
+    )
+    # Always send the cookie, even after its browser expiry, to exercise
+    # Datasette's verification of the signed expiration timestamp.
+    headers = {"Cookie": "ds_actor={}".format(response.cookies["ds_actor"])}
+    lifetime = max_age if max_age is not None else 2592000
+    now += lifetime - 1
+    response = await ds.client.get("/-/actor.json", headers=headers)
+    assert response.json()["actor"]["id"] == "github:123"
+    now += 2
+    response = await ds.client.get("/-/actor.json", headers=headers)
+    if max_age is None:
+        assert response.json()["actor"]["id"] == "github:123"
+    else:
+        assert response.json()["actor"] is None
+
+
+@pytest.mark.parametrize("value", [True, False, 0, -1, "3600", 1.5])
+def test_invalid_login_max_age(value):
+    with pytest.raises(
+        ValueError, match="^login_max_age must be a positive integer or null$"
+    ):
+        verify_config({"login_max_age": value})
+
+
 @pytest.mark.asyncio
 async def test_sign_in_with_github_button(ds):
     response = await ds.client.get("/")
@@ -197,11 +318,14 @@ async def test_database_access_permissions(
         )
         cookies = {"ds_actor": auth_response.cookies["ds_actor"]}
     databases = await ds.client.get("/.json", cookies=cookies)
-    # This differs between Datasette <1.0 and >=1.0a20
-    if "databases" in databases.json():
-        assert set(databases.json()["databases"].keys()) == expected_databases
-    else:
-        assert set(databases.json().keys()) == expected_databases
+    # Datasette versions expose databases as a top-level or nested dictionary,
+    # or as a list of objects with a name field.
+    data = databases.json()
+    data = data.get("databases", data)
+    names = (
+        {database["name"] for database in data} if isinstance(data, list) else set(data)
+    )
+    assert names == expected_databases
 
 
 @pytest.mark.asyncio
@@ -235,9 +359,9 @@ async def test_github_enterprise_host(tmpdir, httpx_mock):
 
     # Create Datasette instance with GitHub Enterprise configuration
     filepath = str(tmpdir / "test.db")
-    ds = Datasette(
+    ds = datasette_with_config(
         [filepath],
-        metadata={
+        config={
             "plugins": {
                 "datasette-auth-github": {
                     "client_id": "enterprise_client_id",