From sysprefs.sql: ('timeout','12000000',NULL,'Inactivity timeout for cookies authentication (in seconds)','Integer'), From C4/Auth.pm: my $timeout = C4::Context->preference('timeout') || 600; Some googling results: The default in PHP is 1440 seconds (24 minutes). 30 minutes (=1800 secs) is the default expiration time of a cookie. This patch proposes to lower 12 million to 1d (one day). The perfect balance between usability and security?? Also note that we are talking about a session cookie. So end of session always means end of game. Who offers less ? And what about changing current values? [Starting with: If it is null or the 12 million secs, change it.]
Created attachment 54828 [details] [review] Bug 17187: Lower the timeout preference from 139 days to 1 day Default timeout is now 12000000 seconds == almost 139 days ! Surely, your session will be shorter. But we should lower this value. Balancing usability and security, I propose 1d (1 day) now. Current pref value will be affected only if it is NULL or equal to the old default. Test plan: Check your current value. Optionally change to NULL or 12000000. Run the dbrev and see what happens. Beware of cached values while testing or flush the cache. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 54882 [details] [review] [SIGNED-OFF] Bug 17187: Lower the timeout preference from 139 days to 1 day Default timeout is now 12000000 seconds == almost 139 days ! Surely, your session will be shorter. But we should lower this value. Balancing usability and security, I propose 1d (1 day) now. Current pref value will be affected only if it is NULL or equal to the old default. Test plan: Check your current value. Optionally change to NULL or 12000000. Run the dbrev and see what happens. Beware of cached values while testing or flush the cache. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Created attachment 54917 [details] [review] Bug 17187: Lower the timeout preference from 139 days to 1 day Default timeout is now 12000000 seconds == almost 139 days ! Surely, your session will be shorter. But we should lower this value. Balancing usability and security, I propose 1d (1 day) now. Current pref value will be affected only if it is NULL or equal to the old default. Test plan: Check your current value. Optionally change to NULL or 12000000. Run the dbrev and see what happens. Beware of cached values while testing or flush the cache. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Pushed to master for 16.11, thanks Marcel!