Setting for session.timeout not working for Admin user after upgrade to 4.19
- 主要語言
- Java
- 星號
- 3.1k
- 分支
- 1.4k
- 平均合併
- 6 天 19 小時
- 30 天內合併 PR
- 32
描述
##### ISSUE TYPE
* Bug Report
##### COMPONENT NAME
~~~
UI
~~~
##### CLOUDSTACK VERSION
~~~
4.19
~~~
##### CONFIGURATION
NA
##### OS / ENVIRONMENT
CentOS 7
##### SUMMARY
After upgrade to 4.19, my web UI Session timeout of 30 minutes seems to have no impact when logged in as the admin user. It works for other users. My /etc/cloudstack/management/server.properties file's setting session.timeout=30 - which used to work earlier and session timed out at 30 minutes of inactivity.
Additionally, I am able to close brower tab (in which I am logged in as admin), open a new tab with original URL (copy paste) and it still works without asking to log in as admin - that is a security risk in my mind.
##### STEPS TO REPRODUCE
~~~
From 4.17 upgrade to 4.19. Verify session.timeout=30 in server.properies file
~~~
##### EXPECTED RESULTS
~~~
Timeout occurs as per the /etc/cloudstack/management/server.properties file's setting session.timeout for all users including admin.
~~~
##### ACTUAL RESULTS
~~~
Timeout is not respected when logged in as admin. I left a session open overnight and I was able to start working without login need.
When logged in as non-admin user, the timeout setting works.
~~~
貢獻指南
研究方向
從 /etc/cloudstack/management/server.properties 中的 session.timeout 設定開始,追蹤從 4.17 升級到 4.19 後 Web UI 如何處理管理員和非管理員使用者的工作階段。重現整晚或 30 分鐘沒有操作的情況,然後確認管理員工作階段會過期,且重新開啟分頁後會如預期要求登入。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- java
- 領域
- authentication, security
- Issue 類型
- 缺陷
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 活躍度
- 活躍
- 描述清晰度
- 基本清楚
- 新手友好度
- 45/100