Tickets :: Comment on [#12136] Session Timeout not enforced

6.0.0-beta6

3/30/26

Comment on [#12136] Session Timeout not enforced

* Your Email Address
* Spam protection	Enter the letters below: . .. . . __ . . \| \|\| \| \|/ `\|\/\| \|__\|\|___\|__\|\__.\| \|
Comment	>> Do Michael's latest commits close this ticket? > > I disagree strongly with the comments. Horde has no reliable session > inactivity timeout mechanism and this needs to be addressed. How can > you argue not to fix a security issue, because its hard to implement?? > > horde currently relies solely on gc_maxlifetime to discard inactive > sessions, which is not reliable! > > see e.g. > http://stackoverflow.com/questions/1236374/session-timeouts-in-php-best-practices
Attachment
Watch this ticket