6.0.0-beta6
▾
Tasks
New Task
Search
Photos
Wiki
▾
Tickets
New Ticket
Search
dev.horde.org
Toggle Alerts Log
Help
3/30/26
H
istory
A
ttachments
C
omment
W
atch
Download
Comment on [#12136] Session Timeout not enforced
*
Your Email Address
*
Spam protection
Enter the letters below:
\ /._.. . __ . . >< | | |/ `|\ | / \_|_|/\|\__.| \|
Comment
> Not to mention the idea of a session "timeout" being the last time > you accessed a server is a dangerous concept. If using something > like dynamic IMP, your session will NEVER time out. So your proposal > actually opens up additional security holes. > > The only way to correctly "timeout" a session is to implement a time > limit AT THE TIME OF THE INITIAL AUTHENTICATION. This is what we > provide via the max_time configuration option. Anything else might > help in certain situations (e.g. a single user system) but will hurt > in other situations (a single user system where the user never closes > their browser).
Attachment
Watch this ticket
N
ew Ticket
M
y Tickets
S
earch
Q
uery Builder
R
eports
Saved Queries
Open Bugs
Bugs waiting for Feedback
Open Bugs in Releases
Open Enhancements
Enhancements waiting for Feedback
Bugs with Patches
Enhancements with Patches
Release Showstoppers
Stalled Tickets
New Tickets
Horde 5 Showstoppers