datasette-auth-github version 1.0 released

Meta description: Datasette's GitHub login plugin hits version 1.0 with a fix for short-lived sessions caused by cookies missing the Max-Age parameter.

Tags: GitHub, plugins, Datasette, authentication, release notes

Featured image: A friendly abstract illustration of a padlock resting on top of a stylized browser cookie, rendered in soft pastel shapes.

Datasette's GitHub Login Plugin Finally Reaches Version 1.0

If you use Datasette and let people sign in with their GitHub accounts, there's a new release you should know about. The datasette-auth-github plugin, which handles GitHub-based authentication for Datasette instances, has been upgraded to version 1.0. This update fixes a frustrating bug that caused logins to expire far sooner than they should, and it signals that the plugin has reached a level of maturity the maintainer is comfortable standing behind. Here's what changed, why it matters, and what to expect if you upgrade.

The Problem: Sessions That Vanished Too Quickly

The maintainer of the plugin runs it on the agent.datasette.io demo site, and while testing there, he noticed something odd: authenticated sessions kept ending much faster than expected. Users were getting logged out well before they should have been.

After some investigation, the cause turned out to be surprisingly simple. When the plugin set its cookies, it never included a Max-Age parameter. Without that parameter, browsers treat a cookie as a "session cookie," meaning it is wiped out as soon as the browsing session ends.

On desktop browsers that might not be a huge deal, but on mobile it becomes a serious annoyance. In Mobile Safari, in particular, browser sessions appear to end very frequently — often regardless of how actively someone is using the app. The practical result was that people signing in through GitHub on an iPhone or iPad would find themselves logged out again almost immediately, forcing them to repeat the login process over and over.

The Fix: Adding an Explicit Cookie Lifetime

The solution was straightforward but important. The fix, submitted as pull request #80, ensures the plugin now sets cookies with a proper Max-Age value, so they persist for a defined period instead of dying with each browser session.

This is exactly the kind of fix that makes a real difference in day-to-day use. Anyone who deploys a Datasette instance behind GitHub authentication — whether for internal team dashboards, public data explorations, or demo sites — will no longer have to deal with sessions evaporating every time someone briefly switches apps on their phone.

Why Version 1.0, and Why Now?

Version numbers are more than just counters; they communicate confidence. The plugin has actually been around for quite a long time and has already proven itself in real-world use. It is actively tested against two different lines of Datasette: the current stable 0.65.x series and the in-progress Datasette 1.0 alpha releases (referred to as 1.0ax).

Given that track record of stability and broad compatibility, bumping the plugin to 1.0 was a natural decision. The maintainer also mentioned a broader goal behind the move: he is deliberately trying to get better at promoting plugins that have proven themselves stable up to a 1.0 release. That's a healthy practice for the ecosystem — it gives users a clear signal about which plugins are battle-tested and safe to rely on in production.

For anyone who has been hesitant to depend on pre-1.0 software, this release removes that hesitation. A 1.0 badge doesn't guarantee perfection, but it does suggest the interfaces are settled and the plugin is ready for serious use.

What This Means for Datasette Users

If you currently run datasette-auth-github on any of your Datasette instances, upgrading to 1.0 is a clear win: your users' sessions will last a sensible amount of time, especially on mobile browsers like Mobile Safari where session cookies were previously short-lived.

If you're evaluating authentication options for Datasette, this release also strengthens the case for the plugin. It works with both the stable 0.65.x line and the upcoming 1.0 alpha series, so it should fit into your setup whether you're running production today or experimenting with the next major version of Datasette.

One thing worth noting: this release does not change how the plugin works conceptually. It still uses GitHub as the identity provider — users click to sign in, authenticate with their GitHub account, and return to your Datasette instance logged in. The change is focused entirely on making those sessions last as long as they should.

Bottom Line

The jump to 1.0 for datasette-auth-github is a small release with an outsized practical impact. The cookie Max-Age fix in pull request #80 solves a genuinely annoying problem for mobile users, and the version bump communicates that this long-running plugin is stable and tested across both Datasette 0.65.x and Datasette 1.0 alphas. If you rely on GitHub login for your Datasette deployments, upgrading is an easy decision — your users' sessions will thank you.