Tickets :: Comment on [#12136] Session Timeout not enforced

* Your Email Address
* Spam protection	Enter the letters below: \ /._.. . __ . . >< \| \| \|/ `\|\ \| / \_\|_\|/\\|\__.\| \\|
Comment	> Not to mention the idea of a session "timeout" being the last time > you accessed a server is a dangerous concept. If using something > like dynamic IMP, your session will NEVER time out. So your proposal > actually opens up additional security holes. > > The only way to correctly "timeout" a session is to implement a time > limit AT THE TIME OF THE INITIAL AUTHENTICATION. This is what we > provide via the max_time configuration option. Anything else might > help in certain situations (e.g. a single user system) but will hurt > in other situations (a single user system where the user never closes > their browser).
Attachment
Watch this ticket