Session cookie does not expire reasonably.

The session cookie I have right now expires April of 2015.

For a security-centric webapp, this seems stupendously long. I'd be much more comfortable with a timeout of something like an hour assuming no activity. That's longer than a bank, shorter than Facebook.

Start by locating the session-cookie configuration and checking how its expiry is calculated. The issue's proposed outcome is an inactivity timeout of about one hour, but the payload names no file, test, or entry point; verify the behavior with the relevant session or authentication tests.

Written by the indexing model from the issue text.