0032963: Session Timeout is Too Long

ID	Project	Category	View Status	Date Submitted	Last Update
0032963	mantisbt	security	public	2023-09-26 11:07	2023-09-26 12:30

Reporter	nhchoudhary	Assigned To
Priority	high	Severity	major	Reproducibility	always
Status	acknowledged	Resolution	open
Product Version	2.25.6

Summary	0032963: Session Timeout is Too Long
Description	The application had profiles configured with idle session timeouts that exceeded corporate security requirements. Excessively long idle session timeouts result in more open, idle sessions for attackers to target. Please let us know how to configure session timeout after 20 minute.
Steps To Reproduce	Login to application and check after 1 hour session still active.
Tags	No tags attached.

dregad 2023-09-26 12:30 developer ~0068137	Please let us know how to configure session timeout after 20 minute. AFAIK, this can't be done globally as of today. Forced session expiration is only implemented in management pages, and the timeout for that can be set with `$g_reauthentication_expiry`. What you can maybe try is set `$g_allow_permanent_cookie = OFF` so the session cookie will expire when browser closes) or change `$g_cookie_time_length = 60 * 20` but I'm not sure that's what you want. Also, you may want to play with expiring PHP session duration ini settings `session.gc_maxlifetime` but that does not give you a deterministic maximum duration. Or you can customize code to call auth_reauthenticate() for every page.