Bug 17187 - Lower the timeout preference from 139 days to 1 day
Summary: Lower the timeout preference from 139 days to 1 day
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: System Administration (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Marcel de Rooy
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-24 11:16 UTC by Marcel de Rooy
Modified: 2017-12-07 22:15 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 17187: Lower the timeout preference from 139 days to 1 day (3.96 KB, patch)
2016-08-24 13:52 UTC, Marcel de Rooy
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17187: Lower the timeout preference from 139 days to 1 day (4.02 KB, patch)
2016-08-25 17:00 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 17187: Lower the timeout preference from 139 days to 1 day (4.03 KB, patch)
2016-08-26 10:05 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2016-08-24 11:16:06 UTC
From sysprefs.sql:  ('timeout','12000000',NULL,'Inactivity timeout for cookies authentication (in seconds)','Integer'),
From C4/Auth.pm:  my $timeout = C4::Context->preference('timeout') || 600;
Some googling results: 
The default in PHP is 1440 seconds (24 minutes).
30 minutes (=1800 secs) is the default expiration time of a cookie.

This patch proposes to lower 12 million to 1d (one day). The perfect balance between usability and security??
Also note that we are talking about a session cookie. So end of session always means end of game.

Who offers less ?
And what about changing current values? [Starting with: If it is null or the 12 million secs, change it.]
Comment 1 Marcel de Rooy 2016-08-24 13:52:22 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2016-08-25 17:00:51 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2016-08-26 10:05:32 UTC
Created attachment 54917 [details] [review]
Bug 17187: Lower the timeout preference from 139 days to 1 day

Default timeout is now 12000000 seconds == almost 139 days !
Surely, your session will be shorter. But we should lower this
value.
Balancing usability and security, I propose 1d (1 day) now.
Current pref value will be affected only if it is NULL or equal
to the old default.

Test plan:
Check your current value. Optionally change to NULL or 12000000.
Run the dbrev and see what happens.
Beware of cached values while testing or flush the cache.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Kyle M Hall 2016-09-09 15:05:41 UTC
Pushed to master for 16.11, thanks Marcel!