The internal rules regarding how long users can stay logged into the CP have undergone numerous changes in the last few version of EE (mainly 2.7.x onward I think). Various config overrides were introduced and then removed again, and the Docs make reference to some changes that are not listed in the change log. So I'm getting a bit lost in what is current and what is not. Specifically:
We used to have cp_session_ttl and user_session_ttl available. Now the documentation mentions that they have been replaced in v2.8, apparently with expire_session_on_browser_close (see: documentation). But the change log for 2.8 makes no mention of expire_session_on_browser_close, in fact as far as I can see it doesn't appear anywhere on the change log page. And this expire_session_on_browser_close config setting does not seem to do quite the same job as the two variables in any case.
And there is also the matter that apparently there was a setting hardcoded into the system to log people out after being idle for a certain amount of time, which was unaffected by either of the two (now deprecated?) config variables.
So my question is: as of the current version (2.9.2) what is the method to control how long a user can stay logged into the CP before being booted out? Is it even possible?
(I'm particularly interested because I keep most of my config variables in a separate file (as per Focus Labs masterConfig system) so the system upgrades of EE don't necessarily remove/rewrite deprecated variables as they might otherwise do if all my config settings were inside the system folder).