Web session not expiring

ℹ️ Support
1

Hello all,

Good day and hoping this finds you well.

just want to know if its normal for the web session to not expire?

this is the configuration ive got on my config.php:
‘session_lifetime’ => 60 * 60 * 1,
‘session_keepalive’ => false,
‘remember_login_cookie_lifetime’ => 60 * 60 * 24 * 7,

now, im using rainloop via web browser, but if i leave the tab open for more than 12 hours it will still be active.

ideally i would like to have it to log you off automatically after 8 hours of inactivity.

Can you please advise?

thanks in advance!

2

Anyone else having this issue?

3

is this normal?

4

The session remains active if the browser has the page loaded.

5

so, correct me if im wrong… if i leave the tab with my nextcloud open it will never expire?

even after inactivity?

Regards!

6

Yes probably since there is JavaScript running checking for notifications etc.

7

so, what would be the need for session expiration if it actually does not expire?

8

If you close the browser then the session will expire so that the server doesn’t keep sessions forever.

You’re looking for auto lock or auto logout. Not sure that exists.

9

I had the same issue and I still wonder, that this security behavior still exists in nextcloud 20.0.1! It is a security leak for me, when a session never ends! To disable long running session you might to set those 3 parameters in your /config/config.php like this:

'session_lifetime' => 3600,
'session_keepalive' => false,
'remember_login_cookie_lifetime' => 0,

The main problem seems to be the cookie lifetime (parameter remember_login_cookie_lifetime). I changed it to zero. This ensures, that I need to login myself again, whenever I close the browser. You can change it’s value to same as session_lifetime to ensure, that the session does not die on browser crashes, but still dies on session timeout.

I hope it helps.

1 Like
10

I can confirm this is still an issue on 27.1.1. With Firefox 115esr, the session for nextcloud never times out. The php.ini setting for session lifetime remains in the default for 8.1 of 24 minutes, e.g. session.gc_maxlifetime = 1440. Even so, I can sit down in the morning and the session in nextcloud is still active. Maybe a recent change triggered a regression?

One other possible contributing factor is I also have the IOS nextcloud app in use for syncing files. That access by my account may be what is responsible for nextcloud thinking my session is still active even though the browser and IOS app would have different session IDs. If it is just checking whether there was activity by the account, then that may explain the behavior. I haven’t looked at the source in nextcloud, so I have no idea what logic is being used, these are simply a few ideas based on what I see happening and possible factors…