datasette-auth-github 1.0 Released: Fixing Session Expiry Issues

Simon Willison recently upgraded his long-maintained Datasette plugin datasette-auth-github to version 1.0. This plugin provides GitHub-based login authentication for Datasette, and the core of this release is a fix for a Cookie expiry issue that was degrading the user login experience.

The Story Behind a Real Login Bug

While running this GitHub login plugin on his demo site agent.datasette.io, the author noticed that authentication sessions were expiring unusually quickly — users had to re-authenticate shortly after logging in.

After investigation, the root cause turned out to be that the plugin wasn't including the Max-Age attribute when setting Cookies. Without this attribute, browsers treat the Cookie as a "session Cookie" and clear it as soon as the browser session ends. The author specifically noted that on Mobile Safari, session termination happens quite frequently and independently of how the user is actually using the app. This caused mobile users to be repeatedly logged out, significantly hurting the experience.

This case is also a reminder to developers: Cookie lifetime configuration is an easy-to-overlook detail in authentication logic that directly impacts user experience. Setting a reasonable Max-Age or Expires value is what keeps authentication state stable for the intended duration.

Cookie lifetime is controlled by two attributes: Max-Age (a relative value in seconds, with higher priority) and Expires (an absolute timestamp). If both are absent, the browser treats the Cookie as a "session Cookie", retaining it only for the current browser session — it can be cleared when a tab is closed, the browser is restarted, or the system wakes from sleep. Mobile Safari's aggressive memory management frequently terminates background tab processes, making this issue particularly pronounced on iOS devices. Even simply switching apps and returning can cause session Cookies to vanish, forcing users to log in again. This stands in sharp contrast to desktop browsers where tabs tend to persist for long periods, and it's a common compatibility pitfall in mobile web app authentication.

The Fix and the Decision to Go 1.0

The author resolved this in issue #80 by adding the Max-Age attribute to the Cookie, allowing authentication sessions to persist even after a browser session ends.

The decision to bump to 1.0 is also worth noting. The author mentioned that this plugin has been around for quite some time and has been tested against both Datasette 0.65.x and Datasette 1.0 alpha. Given the plugin's maturity and stability, he decided to use this fix as an opportunity to formally promote it to 1.0.

The author also candidly shared that he's been trying to build a habit of formally marking sufficiently stable plugins as 1.0. This reflects a versioning philosophy — 1.0 isn't just a number, it's a promise of stability to users.

Significance for the Datasette Ecosystem

Datasette is an open-source tool for exploring and publishing data, and its plugin ecosystem is a key part of its extensibility. As an authentication plugin, datasette-auth-github lets developers easily protect their Datasette instances using GitHub accounts — ideal for internal data tools, demo sites, and other scenarios requiring access control.

The decision to test against both the stable Datasette 0.65.x and the 1.0 alpha also demonstrates that the plugin can continue to provide reliable support for users on different versions during Datasette's own transition to 1.0. For users who depend on this plugin, upgrading to 1.0 directly will deliver a more stable login session experience.

Datasette is developed by Simon Willison, built on Python and SQLite, with the core philosophy that "any SQLite database can be published as an interactive Web API and data browsing interface with a single command." Its plugin system works through Python package entry points — once a plugin is installed, Datasette loads it automatically without any changes to the core code. Datasette is currently in transition from the 0.x series to the official 1.0 release, and there are some API differences between the two versions for plugins. Supporting both simultaneously requires extra compatibility work from plugin maintainers, and datasette-auth-github's ability to support both 0.65.x and 1.0 alpha reflects the maintenance investment made during this transition period.

Conclusion

This update may be small in scope, but it's a classic example of a "minor fix with a major experience improvement." A single missing Cookie attribute was causing noticeable usability issues on mobile. The fix, combined with a maturity assessment, led to a timely 1.0 release that both addresses a real pain point and sets a clearer versioning baseline for the plugin's long-term maintenance. For open-source tool maintainers, formally marking stable projects as 1.0 is itself a responsible practice.