# Is there a way to set session expiration after a set length of time? **URL:** \ **Category:** Feature\ **Created:** [2014年三月16日 00:46 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769 "2014-03-16T00:46:31Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![joel6890](https://avatars.discourse-cdn.com/v4/letter/j/bb73d2/32.png) [@joel6890](https://meta.discourse.org/u/joel6890)\ **Post date:** [2014年三月16日 00:46 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/1 "2014-03-16T00:46:31Z")
Maybe I am missing this in the Admin settings somewhere – but is there a way to set session expiration times so that if a user is not active for a specified length of time they will have to log in again? I would use such a feature if it were available. ---
**Author:** ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\ **Post date:** [2014年三月16日 03:21 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/2 "2014-03-16T03:21:43Z")
What’s your use-case that you would use it for? ---
**Author:** ![davidcelis](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidcelis/32/454421_2.png) [@davidcelis](https://meta.discourse.org/u/davidcelis)\ **Post date:** [2014年三月16日 17:34 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/3 "2014-03-16T17:34:25Z")
At this point, you’d basically need to set a custom CurrentUserProvider in a plugin. Check out the [default current user implementation](https://github.com/discourse/discourse/blob/master/lib/auth/default_current_user_provider.rb) to get an idea of how they currently set the current user. You could probably copy most of that but set an expiry on the cookie. ---
**Author:** ![jvenator](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jvenator/32/108392_2.png) [@jvenator](https://meta.discourse.org/u/jvenator)\ **Post date:** [2014年三月16日 19:22 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/4 "2014-03-16T19:22:22Z")
I have a topic open regarding the lack of a required password for invites from a trusted user: [https://meta.discourse.org/t/require-password-for-trusted-user-invites/13750](https://meta.discourse.org/t/require-password-for-trusted-user-invites/13750) One of the possible solutions is a limitation on how long the tokenized invite link will work. Expiring sessions would be an indirect way of addressing the issue(s) I raised. Although, it seems like clicking on the original invite link would just initiate a new session regardless. ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2014年三月16日 23:13 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/5 "2014-03-16T23:13:52Z")
Totally open to having an option in core, however there would need to be a few changes made. I am comfortable with the keep me logged in forever, feel it complicates stuff for no great reason having people logged off randomly. Google keeps you logged on “forever”, facebook the same. Facebook allows you to have a “temporary” session, with the “keep me logged on” option. I am open to: 1. Adding a “keep me logged on” option to the login dialog (enabled via site setting) 2. Adding an option to auto expire sessions after N hours of inactivity (enabled via site setting) We are way too busy to work on this at the moment, would have to come from the community. ---
**Author:** ![joel6890](https://avatars.discourse-cdn.com/v4/letter/j/bb73d2/32.png) [@joel6890](https://meta.discourse.org/u/joel6890)\ **Post date:** [2014年三月17日 12:12 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/6 "2014-03-17T12:12:35Z")
Thanks to everyone for your responses. > [@riking](#): > > What’s your use-case that you would use it for? I figured I should be prepared to answer that. 😉 I’m hosting a forum where committee members, accountability partners, etc. across our churches can discuss options for computer / mobile device security. Some folks who have access will be visiting for how-to guides; how can I disable browsing on my son’s smart phone? or how can we force a laptop to run its web traffic through a filtering proxy? etc. Obviously some of this is more secure if the methods used are not open to everybody; not as easy to scheme ways to circumvent them. I like the option of being logged in indefinitely, but some of my users might appreciate if their session expired after some time so that not just anyone can come along to their computer, hit the forum address, and have access to everything. Not that the forum’s content is that private, necessarily; just the security reasons I mentioned above. For now I’m encouraging users to log out when done. Make sense? > [@sam](#): > > We are way too busy to work on this at the moment No rush. And I’m not going to make much noise about it. Not a huge deal, just another feature for you to implement when you run out of ideas and time lies heavy on your hands. 🙂 ---
**Author:** ![kpfleming](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kpfleming/32/116414_2.png) [@kpfleming](https://meta.discourse.org/u/kpfleming)\ **Post date:** [2014年三月17日 14:15 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/7 "2014-03-17T14:15:39Z")
I’m not sure Google does what you are saying; I have tabs open to Google Mail and Google Calendar, and periodically (every few weeks) I am required to log in again. As we discussed months ago, for our deployment we’ll need to be able to _expire_ active login sessions if the authentication provider indicates that the identity used for the session is no longer valid. Anyone using a corporate auth provider for Discourse will likely require this. ---
**Author:** ![joel6890](https://avatars.discourse-cdn.com/v4/letter/j/bb73d2/32.png) [@joel6890](https://meta.discourse.org/u/joel6890)\ **Post date:** [2014年三月17日 15:13 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/8 "2014-03-17T15:13:01Z")
> [@kpfleming](#): > > periodically (every few weeks) I am required to log in again. Ya, same here. I don’t know how often it is, but Gmail keeps booting me out and asking for my password every once in a while. Almost seems sort of random. Anyway, I need to re-enter my password, log in again, and carry on. ---
**Author:** ![jesselperry](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jesselperry/32/119501_2.png) [@jesselperry](https://meta.discourse.org/u/jesselperry)\ **Post date:** [2015年三月30日 18:34 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/9 "2015-03-30T18:34:49Z")
If this is still being considered - I would love to be able to set a universal “keep me logged in forever” setting. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2015年三月30日 21:50 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/10 "2015-03-30T21:50:33Z")
At the very least duration of login should be editable in site settings. Not sure how hard this is to make a site setting variable @sam but it should be there. ---
**Author:** ![Andy\_Rothfusz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/andy_rothfusz/32/116974_2.png) [@Andy\_Rothfusz](https://meta.discourse.org/u/Andy_Rothfusz)\ **Post date:** [2015年十月21日 16:50 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/11 "2015-10-21T16:50:35Z")
I think session expiration is required for anyone using SSO as access control. If you only think of SSO as another way to get a verified email address and then the user is part of the Discourse community forever and ever, then non-expiring sessions are great. But if you’re using SSO to control who has access to your Discourse, so that when your SSO system says they’re **not** a member anymore they no longer can access Discourse, then you need expiring sessions and/or a requirement to check back with the SSO system to ensure the person is still in good standing. When the SSO says that an existing Discourse user is **not** in good standing, then all existing email subscriptions in Discourse should also be disabled. Only users in good standing should be able to get information out of my Discourse forum. If there is another solution to my controlled access problem, I’d love to hear about it. ---
**Author:** ![kpfleming](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kpfleming/32/116414_2.png) [@kpfleming](https://meta.discourse.org/u/kpfleming)\ **Post date:** [2015年十月23日 04:32 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/12 "2015-10-23T04:32:07Z")
I will need this same sort of thing; we plan to use our OAuth provider to allow our employees to login with extra privileges, but if an employee’s account is deactivated, then any existing Discourse sessions need to be terminated. ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2015年十月31日 04:50 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/13 "2015-10-31T04:50:55Z")
This is pretty straight forward using the API there is an Admin API endpoint for logging out a user, you would issue it from your end. ---
**Author:** ![kpfleming](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kpfleming/32/116414_2.png) [@kpfleming](https://meta.discourse.org/u/kpfleming)\ **Post date:** [2015年十一月2日 14:38 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/14 "2015-11-02T14:38:37Z")
Unfortunately we cannot issue API calls from our authentication provider, there will have to be some sort of ‘pull’ mechanism to notice that a session is no longer valid. ---
**Author:** ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)\ **Post date:** [2015年十一月2日 14:44 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/15 "2015-11-02T14:44:32Z")
Yes, the Oauth provider isn’t the right place for this, it’s typically the role of identity management. The only alternative is to set a very short Discourse session expiration so that Oauth is being hit very regularly to check if it’s still valid. Depending upon your scale and the value of that setting though that could lead to Discourse hammering your authentication provider quite unpleasantly. ---
**Author:** ![Andy\_Rothfusz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/andy_rothfusz/32/116974_2.png) [@Andy\_Rothfusz](https://meta.discourse.org/u/Andy_Rothfusz)\ **Post date:** [2015年十一月2日 17:42 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/16 "2015-11-02T17:42:35Z")
Ok, logging them out solves part of the problem. What is the right way to also disable their notifications? ---
**Author:** ![sessionstart](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sessionstart/32/67305_2.png) [@sessionstart](https://meta.discourse.org/u/sessionstart)\ **Post date:** [2017年二月5日 10:13 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/17 "2017-02-05T10:13:08Z")
> [@sam](#): > > I am comfortable with the keep me logged in forever, feel it complicates stuff for no great reason having people logged off randomly. Is redis handling the session for Discourse users? If so, the memory will be eaten all. ---
**Author:** ![kraml](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kraml/32/68627_2.png) [@kraml](https://meta.discourse.org/u/kraml)\ **Post date:** [2017年四月5日 05:29 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/18 "2017-04-05T05:29:56Z")
Any one know whether there is any news? I’m currently working on a website SSO integration with Discourse. One problem we found is when the user login expired on the website itself, the session is still valid in Discourse. It seems Discourse still don’t set a login expiration time at least for SSO, while the website defaults to 1 month. This cause confusing user experience. A user found out he was auto logged out on website due to login expired, however when he switched to forum he’s still displayed as logged in. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年四月5日 06:51 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/19 "2017-04-05T06:51:32Z")
Don’t we have a login cookie expiration time site setting now @sam? ---
**Author:** ![kraml](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kraml/32/68627_2.png) [@kraml](https://meta.discourse.org/u/kraml)\ **Post date:** [2017年四月5日 07:00 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/20 "2017-04-05T07:00:48Z")
I can’t find a login expiration site setting yet. And even if it exists, it can’t solve the problem. Imaging that a user logged in on the website today, and only navigate to forum tomorrow. He won’t get the forum cookie until he navigates to it. So even though we can set cookie from both side to a same period, there still is one day difference. I think we need to be able to specify the expiration time on a per login basis. When the SSO login happens, the web site is able to check when the user’s website cookie is going to expire, and set the Discourse cookie expire time to that exact same time. [下一頁](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769.md?page=2)