Graylog2 / Graylog2/graylog2-server
Web UI Session Close when Browser is Closed
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
For Security Users and Reasons, sessions should be closed when you close your browser. The ability for a user to do sessions hijacking, by taking the cookies and having access back to Graylog is a security risk and audit point, and should be configurable if it is enabled
Would like a way to enable this feature, where if you close your browser out, your sessions is destroyed, and forced to log back in every time. This would sit beside the normal timeout method as well.
## Why?
Many large organizations have the need to ensure all adminstrative sessions have a timeout (We currently can configure) and all sessions are close when the browser exits. Right now our timeout works, but not if we close the browser and go back to the UI.
Other Ideas in ticket #2551
## Your Environment
* Graylog Version: 3.2+
* Elasticsearch Version: 6.8
* MongoDB Version: 4.x
* Operating System: ANY
* Browser version: ANY
Contributor guide
Assessment
This issue has not been assessed yet.