[Bug 17187] New: Lower the timeout preference from 139 days to 1 day
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17187 Bug ID: 17187 Summary: Lower the timeout preference from 139 days to 1 day Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs@lists.koha-community.org Reporter: m.de.rooy@rijksmuseum.nl QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com
From sysprefs.sql: ('timeout','12000000',NULL,'Inactivity timeout for cookies authentication (in seconds)','Integer'), From C4/Auth.pm: my $timeout = C4::Context->preference('timeout') || 600; Some googling results: The default in PHP is 1440 seconds (24 minutes). 30 minutes (=1800 secs) is the default expiration time of a cookie.
This patch proposes to lower 12 million to 1d (one day). The perfect balance between usability and security?? Also note that we are talking about a session cookie. So end of session always means end of game. Who offers less ? And what about changing current values? [Starting with: If it is null or the 12 million secs, change it.] -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17187 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=17110 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17187 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17187 --- Comment #1 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 54828 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54828&action=edit Bug 17187: Lower the timeout preference from 139 days to 1 day Default timeout is now 12000000 seconds == almost 139 days ! Surely, your session will be shorter. But we should lower this value. Balancing usability and security, I propose 1d (1 day) now. Current pref value will be affected only if it is NULL or equal to the old default. Test plan: Check your current value. Optionally change to NULL or 12000000. Run the dbrev and see what happens. Beware of cached values while testing or flush the cache. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17187 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |m.de.rooy@rijksmuseum.nl |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17187 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17187 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54828|0 |1 is obsolete| | --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 54882 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54882&action=edit [SIGNED-OFF] Bug 17187: Lower the timeout preference from 139 days to 1 day Default timeout is now 12000000 seconds == almost 139 days ! Surely, your session will be shorter. But we should lower this value. Balancing usability and security, I propose 1d (1 day) now. Current pref value will be affected only if it is NULL or equal to the old default. Test plan: Check your current value. Optionally change to NULL or 12000000. Run the dbrev and see what happens. Beware of cached values while testing or flush the cache. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17187 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17187 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54882|0 |1 is obsolete| | --- Comment #3 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 54917 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54917&action=edit Bug 17187: Lower the timeout preference from 139 days to 1 day Default timeout is now 12000000 seconds == almost 139 days ! Surely, your session will be shorter. But we should lower this value. Balancing usability and security, I propose 1d (1 day) now. Current pref value will be affected only if it is NULL or equal to the old default. Test plan: Check your current value. Optionally change to NULL or 12000000. Run the dbrev and see what happens. Beware of cached values while testing or flush the cache. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17187 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com Status|Passed QA |Pushed to Master --- Comment #4 from Kyle M Hall <kyle@bywatersolutions.com> --- Pushed to master for 16.11, thanks Marcel! -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org