Tickets :: Comment on [#12136] Session Timeout not enforced

* Your Email Address
* Spam protection	Enter the letters below: .__ .__ . . . __ [__)[ __\| \| \|/ ` [__)[_./\|___\|__\|\__.
Comment	> Currently horde relies only on session.gc_maxlifetime to enforce session > timeouts. > > Especially on systems where gc_probability needs to be low for > performance reasons or on low traffic servers this is a serious > problem, since sessions might be significantly longer valid, than it was > intended by the admin by setting conf['session']['timeout']. > > Therefore we should always check the last modification of the > session and deny authentication if the session should have timeouted. > > still working on a patch...
Attachment
Watch this ticket