| Summary: | Lower the timeout preference from 139 days to 1 day | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Marcel de Rooy <m.de.rooy> |
| Component: | System Administration | Assignee: | Marcel de Rooy <m.de.rooy> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | gmcharlt, kyle |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17110 | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | Small patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Bug 17187: Lower the timeout preference from 139 days to 1 day
[SIGNED-OFF] Bug 17187: Lower the timeout preference from 139 days to 1 day Bug 17187: Lower the timeout preference from 139 days to 1 day |
||
Created attachment 54828 [details] [review] Bug 17187: Lower the timeout preference from 139 days to 1 day Default timeout is now 12000000 seconds == almost 139 days ! Surely, your session will be shorter. But we should lower this value. Balancing usability and security, I propose 1d (1 day) now. Current pref value will be affected only if it is NULL or equal to the old default. Test plan: Check your current value. Optionally change to NULL or 12000000. Run the dbrev and see what happens. Beware of cached values while testing or flush the cache. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 54882 [details] [review] [SIGNED-OFF] Bug 17187: Lower the timeout preference from 139 days to 1 day Default timeout is now 12000000 seconds == almost 139 days ! Surely, your session will be shorter. But we should lower this value. Balancing usability and security, I propose 1d (1 day) now. Current pref value will be affected only if it is NULL or equal to the old default. Test plan: Check your current value. Optionally change to NULL or 12000000. Run the dbrev and see what happens. Beware of cached values while testing or flush the cache. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Owen Leonard <oleonard@myacpl.org> Created attachment 54917 [details] [review] Bug 17187: Lower the timeout preference from 139 days to 1 day Default timeout is now 12000000 seconds == almost 139 days ! Surely, your session will be shorter. But we should lower this value. Balancing usability and security, I propose 1d (1 day) now. Current pref value will be affected only if it is NULL or equal to the old default. Test plan: Check your current value. Optionally change to NULL or 12000000. Run the dbrev and see what happens. Beware of cached values while testing or flush the cache. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Pushed to master for 16.11, thanks Marcel! |
From sysprefs.sql: ('timeout','12000000',NULL,'Inactivity timeout for cookies authentication (in seconds)','Integer'), From C4/Auth.pm: my $timeout = C4::Context->preference('timeout') || 600; Some googling results: The default in PHP is 1440 seconds (24 minutes). 30 minutes (=1800 secs) is the default expiration time of a cookie. This patch proposes to lower 12 million to 1d (one day). The perfect balance between usability and security?? Also note that we are talking about a session cookie. So end of session always means end of game. Who offers less ? And what about changing current values? [Starting with: If it is null or the 12 million secs, change it.]