Setting for session.timeout not working for Admin user after upgrade to 4.19
- Dominant language
- Java
- Stars
- 3.1k
- Forks
- 1.4k
- Avg merge
- 6d 19h
- Merged PRs (30d)
- 32
Description
##### ISSUE TYPE
* Bug Report
##### COMPONENT NAME
~~~
UI
~~~
##### CLOUDSTACK VERSION
~~~
4.19
~~~
##### CONFIGURATION
NA
##### OS / ENVIRONMENT
CentOS 7
##### SUMMARY
After upgrade to 4.19, my web UI Session timeout of 30 minutes seems to have no impact when logged in as the admin user. It works for other users. My /etc/cloudstack/management/server.properties file's setting session.timeout=30 - which used to work earlier and session timed out at 30 minutes of inactivity.
Additionally, I am able to close brower tab (in which I am logged in as admin), open a new tab with original URL (copy paste) and it still works without asking to log in as admin - that is a security risk in my mind.
##### STEPS TO REPRODUCE
~~~
From 4.17 upgrade to 4.19. Verify session.timeout=30 in server.properies file
~~~
##### EXPECTED RESULTS
~~~
Timeout occurs as per the /etc/cloudstack/management/server.properties file's setting session.timeout for all users including admin.
~~~
##### ACTUAL RESULTS
~~~
Timeout is not respected when logged in as admin. I left a session open overnight and I was able to start working without login need.
When logged in as non-admin user, the timeout setting works.
~~~
Contributor guide
Research direction
Start with the /etc/cloudstack/management/server.properties setting session.timeout and trace how the web UI handles sessions for admin and non-admin users after upgrading from 4.17 to 4.19. Reproduce the overnight or 30-minute inactivity case, then verify that admin sessions expire and reopening the tab requires login as expected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100