The login timeout in webwork seems to be quite short - I was testing a gateway quiz, and had it configured to allow 60 minutes to take the quiz. I also had it configured so all problems appear on a single page (I haven't tested whether this actually makes any difference). After about 39 minutes I clicked the "Grade" button, and up popped the webwork login screen. I got nervous that I'd lost everything, and I'm sure some students would panic too. After I logged in, however, it turned out that the quiz had been properly submitted.
Where is the login timeout defined? (The only thing on timeout I could find in global.conf had to do with ldap, which we're not using.) I'd like to change the login timeout - 2 hours seems like a more reasonable period.
The advice from Miguel-Angel works. But defaults.config is typically not a file one wants to edit: doing so will cause problems when updating via git.
Two questions on how to do this "better":
Is there a line we can add to localOverrides.conf or elsewhere (one of the files we're meant to edit)?
And can we adjust this on a course by course basis?
One should not edit defaults.config ever.
If you want to change any of the default settings server-wide, you can put the same command in localOverrides.conf. In this case that would mean adding the following line to localOverrides.conf:
$sessionKeyTimeout = 7200;
Note that the time is in seconds, so adjust accordingly.
To change a setting for a single course, you can add the command to the course.conf file in that course's directory.
Note that some configuration options (including this one) can be set from within the WeBWorK interface by clicking on "Course Configuration".
These are the four places for WeBWorK configuration, in order of precedence (where the later ones override earlier ones):
defaults.config - Do not edit this file. It will cause problems when you upgrade
localOverrides.conf - For global changes to any of the settings in defaults.config
course.conf - Configuration specific to a course not available through the web interface
simple.conf - Don't edit this file. It is created by the "Course Configuration" page in the web interface
You should not edit defaults.config, as it will cause problems when updating via git as you said. Anything that is set in defaults.config can be set in localOverrides.conf, and that is where it should be done. That will override anything in defaults.config.
Many of these settings can also be set on a course by course basis by editing the course.conf file in the course directory. Of course that still requires admin access (not really though).