Graylog2 / Graylog2/graylog2-server

Web UI Session Close when Browser is Closed

Open
#8,045 0 comments 0 reactions 0 assignees View on GitHub
feature triaged users
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

For Security Users and Reasons, sessions should be closed when you close your browser. The ability for a user to do sessions hijacking, by taking the cookies and having access back to Graylog is a security risk and audit point, and should be configurable if it is enabled

Would like a way to enable this feature, where if you close your browser out, your sessions is destroyed, and forced to log back in every time. This would sit beside the normal timeout method as well.

## Why?
Many large organizations have the need to ensure all adminstrative sessions have a timeout (We currently can configure) and all sessions are close when the browser exits. Right now our timeout works, but not if we close the browser and go back to the UI.

Other Ideas in ticket #2551

## Your Environment

* Graylog Version: 3.2+
* Elasticsearch Version: 6.8
* MongoDB Version: 4.x
* Operating System: ANY
* Browser version: ANY

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.