Skip to main content

Session timeout

The UI signs a user out after a period without activity, and again after a maximum session length however active they are. Both limits are on by default and set on the UI deployment.

LimitDefaultWhat happens
Idle timeout15 minutesA warning appears one minute before, then the user is signed out
Maximum session5 hoursThe user is signed out when the time is up, whether or not they are active

The current values appear under Configure → Settings, in the Web UI group.

Quick start​

The example sets the idle timeout to 30 minutes and the maximum session to 8 hours.

  1. Set the values. Add them to enterpriseWeb.env in the values file you installed with. Every value is in milliseconds.

    my-values.yaml
    enterpriseWeb:
      env:
        - name: NEXTAUTH_URL
          value: ""
        - name: NEXT_PUBLIC_IDLE_TIMEOUT_MS
          value: "1800000"
        - name: NEXT_PUBLIC_MAX_SESSION_DURATION_MS
          value: "28800000"

    enterpriseWeb.env is a list, and a list in a values file replaces the chart's list rather than adding to it. Keep the NEXTAUTH_URL entry, with the value you installed with.

  2. Apply them. Run the install command from Install with Helm again. The UI pods restart with the new values, which signs everyone out.

  3. Check them. Open Configure → Settings and read the Web UI group.

Settings​

VariableMeaningDefault
NEXT_PUBLIC_IDLE_TIMEOUT_MSTime without activity before the user is signed out900000 (15 min)
NEXT_PUBLIC_IDLE_WARNING_LEAD_MSHow long before the idle timeout the warning appears60000 (1 min)
NEXT_PUBLIC_MAX_SESSION_DURATION_MSLongest a session lasts from sign-in, active or not18000000 (5 h)

A value that is not a positive number falls back to its default. A warning lead longer than the idle timeout shows the warning as soon as the user goes idle.

The idle timeout cannot be turned off. To make it rarely matter, set it close to the maximum session length.

What counts as activity​

Moving the mouse, clicking, typing, touching the screen, and scrolling in the UI reset the idle timer, as does returning to a UI tab. Nothing in a tab that is hidden behind another tab or window counts, and neither does a page refreshing its own data.

The warning​

When the warning lead is reached, a dialog titled Session expiring soon counts down the seconds left. While it is open, moving the mouse no longer counts as activity:

  • Stay signed in resets the idle timer and closes the dialog.
  • Sign out now signs the user out at once.

If the countdown reaches zero, the user is signed out.

The maximum session length has no warning.

Several tabs​

The UI tabs open in one browser share one session:

  • Activity in any tab keeps every tab signed in, and dismisses a warning open in another tab.
  • Signing out in one tab, or being signed out by either limit, signs out every tab.
  • Signing in again in one tab reloads the others under the new session.

After a timeout​

The user is taken straight to the sign-in page, which says why: the session expired through inactivity, or it reached the maximum duration. Signing in again starts a new session.

The limits are also enforced by the UI's server, not only in the browser. A request from a session past either limit is refused and sends the user to sign in, even if the browser was closed or asleep when the time ran out.

Restarting the UI pods signs every user out.

Scope​

Both limits apply only to sign-in sessions in the UI. They do not affect:

An OAuth access token keeps the lifetime your identity provider gives it, independent of these limits; see Authentication.

The server property gravitino.server.webserver.idleTimeout is a different setting: it closes idle HTTP connections to the server after 30 seconds by default, and has nothing to do with sign-in sessions. See Server configuration.

Last updated on