Bug 17187

Summary: Lower the timeout preference from 139 days to 1 day
Product: Koha Reporter: Marcel de Rooy <m.de.rooy>
Component: System AdministrationAssignee: Marcel de Rooy <m.de.rooy>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: gmcharlt, kyle
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17110
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 17187: Lower the timeout preference from 139 days to 1 day
[SIGNED-OFF] Bug 17187: Lower the timeout preference from 139 days to 1 day
Bug 17187: Lower the timeout preference from 139 days to 1 day

Description Marcel de Rooy 2016-08-24 11:16:06 UTC
From sysprefs.sql:  ('timeout','12000000',NULL,'Inactivity timeout for cookies authentication (in seconds)','Integer'),
From C4/Auth.pm:  my $timeout = C4::Context->preference('timeout') || 600;
Some googling results: 
The default in PHP is 1440 seconds (24 minutes).
30 minutes (=1800 secs) is the default expiration time of a cookie.

This patch proposes to lower 12 million to 1d (one day). The perfect balance between usability and security??
Also note that we are talking about a session cookie. So end of session always means end of game.

Who offers less ?
And what about changing current values? [Starting with: If it is null or the 12 million secs, change it.]
Comment 1 Marcel de Rooy 2016-08-24 13:52:22 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2016-08-25 17:00:51 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2016-08-26 10:05:32 UTC
Created attachment 54917 [details] [review]
Bug 17187: Lower the timeout preference from 139 days to 1 day

Default timeout is now 12000000 seconds == almost 139 days !
Surely, your session will be shorter. But we should lower this
value.
Balancing usability and security, I propose 1d (1 day) now.
Current pref value will be affected only if it is NULL or equal
to the old default.

Test plan:
Check your current value. Optionally change to NULL or 12000000.
Run the dbrev and see what happens.
Beware of cached values while testing or flush the cache.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Kyle M Hall 2016-09-09 15:05:41 UTC
Pushed to master for 16.11, thanks Marcel!