apache / apache/cloudstack

Setting for session.timeout not working for Admin user after upgrade to 4.19

未关闭
#9,328 8 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
component:UI
主要语言
Java
星标
3.1k
派生
1.4k
平均合并
6 天 19 小时
30 天内合并 PR
32

描述

##### ISSUE TYPE

* Bug Report

##### COMPONENT NAME

~~~
UI
~~~

##### CLOUDSTACK VERSION

~~~
4.19
~~~

##### CONFIGURATION

NA

##### OS / ENVIRONMENT

CentOS 7

##### SUMMARY

After upgrade to 4.19, my web UI Session timeout of 30 minutes seems to have no impact when logged in as the admin user. It works for other users. My /etc/cloudstack/management/server.properties file's setting session.timeout=30 - which used to work earlier and session timed out at 30 minutes of inactivity.
Additionally, I am able to close brower tab (in which I am logged in as admin), open a new tab with original URL (copy paste) and it still works without asking to log in as admin - that is a security risk in my mind.

##### STEPS TO REPRODUCE

~~~
From 4.17 upgrade to 4.19. Verify session.timeout=30 in server.properies file
~~~

##### EXPECTED RESULTS

~~~
Timeout occurs as per the /etc/cloudstack/management/server.properties file's setting session.timeout for all users including admin.
~~~

##### ACTUAL RESULTS

~~~
Timeout is not respected when logged in as admin. I left a session open overnight and I was able to start working without login need.
When logged in as non-admin user, the timeout setting works.
~~~

贡献指南

打开贡献指南

调研方向

从 /etc/cloudstack/management/server.properties 中的 session.timeout 设置开始,跟踪从 4.17 升级到 4.19 后 Web UI 如何处理管理员和非管理员用户的会话。重现整夜或 30 分钟无操作的情况,然后验证管理员会话已过期,并且重新打开标签页后会按预期要求登录。

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
authentication, security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
活跃
描述清晰度
基本清楚
新手友好度
45/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。