# Is there a way to set session expiration after a set length of time?

**URL:** https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769
**Category:** Feature
**Created:** [16 maart 2014 om 00:46 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769 "2014-03-16T00:46:31Z")
**Posts on this page:** 5
**Page:** 2

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [5 april 2017 om 07:24 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/21 "2017-04-05T07:24:36Z")

</div>

I believe there is a route you can use to force sso accounts to be logged out in Discourse.

---

<div class="post-metadata">

### Author: ![kraml](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kraml/32/68627_2.png) [@kraml](https://meta.discourse.org/u/kraml)
#### Post date: [5 april 2017 om 07:54 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/22 "2017-04-05T07:54:24Z")

</div>

Yes there is a `/admin/users/{user_id}/log_out` URL to logout a user.

The problem is, cookie expiration happens in the browser, the server side code don’t know about it thus don’t know when to use above URL to log out a user.

---

<div class="post-metadata">

### Author: ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [5 april 2017 om 08:01 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/23 "2017-04-05T08:01:03Z")

</div>

The easiest way might be to track session validity in your SSO-providing application and issue this API call to log out users when appropriate. This also increases the security of your application: Without this, a stolen session cookie could be used forever!

---

<div class="post-metadata">

### Author: ![kraml](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kraml/32/68627_2.png) [@kraml](https://meta.discourse.org/u/kraml)
#### Post date: [5 april 2017 om 08:04 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/24 "2017-04-05T08:04:14Z")

</div>

Yes we are think about this also. If there is no session expiration function in Discourse or won’t be anytime soon, seems that will be our only choice.

---

<div class="post-metadata">

### Author: ![chapoi](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/chapoi/32/537252_2.png) [@chapoi](https://meta.discourse.org/u/chapoi)
#### Post date: [4 december 2025 om 11:09 UTC](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769/25 "2025-12-04T11:09:28Z")

</div>



[Vorige pagina](https://meta.discourse.org/t/is-there-a-way-to-set-session-expiration-after-a-set-length-of-time/13769.md?page=1)