# Session Timeout
**URL:** https://meta.discourse.org/t/session-timeout/34686
**Category:** Data & reporting
**Created:** [October 19, 2015, 7:26pm UTC](https://meta.discourse.org/t/session-timeout/34686 "2015-10-19T19:26:35Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@ATPJD](https://meta.discourse.org/u/ATPJD)
#### Post date: [October 19, 2015, 7:26pm UTC](https://meta.discourse.org/t/session-timeout/34686/1 "2015-10-19T19:26:35Z")
Is there a secret configuration option to allow me to limit how long a user remains signed-in?
I would like users to be signed-out automatically after 30 minutes of inactivity.
Thanks for any pointers.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 19, 2015, 8:07pm UTC](https://meta.discourse.org/t/session-timeout/34686/2 "2015-10-19T20:07:28Z")
Yes, I thought we had a site setting for this but it is hard to search for since the terms are so generic. @sam can you remember?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 19, 2015, 8:48pm UTC](https://meta.discourse.org/t/session-timeout/34686/3 "2015-10-19T20:48:38Z")
It is not configurable at the moment, we would need to add that as a feature.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 19, 2015, 9:16pm UTC](https://meta.discourse.org/t/session-timeout/34686/4 "2015-10-19T21:16:55Z")
I do think we should have this as a site setting…
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [October 19, 2015, 9:25pm UTC](https://meta.discourse.org/t/session-timeout/34686/5 "2015-10-19T21:25:10Z")
I’m concerned that a site admin is going to set this too low and make it impossible for anyone to write a post or get any reading done.
---
### Author:  [@ATPJD](https://meta.discourse.org/u/ATPJD)
#### Post date: [October 19, 2015, 10:17pm UTC](https://meta.discourse.org/t/session-timeout/34686/6 "2015-10-19T22:17:49Z")
A bit more information:
We use Discourse for an employee message board / forum. All sign-ins are managed through the the documented single sign-on integration. Because employees typically use shared computers, we have a commonly recurring issue where people write posts attributed to the wrong (but currently signed-in) user.
My request for session time-out would be negated if I could have our SSO integration also sign people out. They are good about signing out of our primary intranet website. So far I’ve not been able to understand the sign-out discussion in the SSO thread.
Any help toward session time out or user sign out would be greatly appreciated. Thanks.
-Justin
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [October 19, 2015, 10:22pm UTC](https://meta.discourse.org/t/session-timeout/34686/7 "2015-10-19T22:22:19Z")
> [@riking](#):
>
> I’m concerned that a site admin is going to set this too low and make it impossible for anyone to write a post or get any reading done.
Wouldn’t the session be extended by both “writing a post” and “reading”?
- Drafts are saved automatically during writing / composing a post (extending the session)
- Reading sends “reading time” tracking information back too (also extending the session).
Perhaps have to be careful if a window is left active for tens of minutes / several hours sending back “reading time” info?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [October 19, 2015, 10:26pm UTC](https://meta.discourse.org/t/session-timeout/34686/8 "2015-10-19T22:26:29Z")
> [@ATPJD](#):
>
> Because employees typically use shared computers, we have a commonly recurring issue where people write posts attributed to the wrong (but currently signed-in) user.
Have you considered setting the browsers to clear cookies on exit?
Also, SSO _can_ log a user out. You need to POST or PUT or something to a /admin/ endpoint.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 19, 2015, 10:41pm UTC](https://meta.discourse.org/t/session-timeout/34686/9 "2015-10-19T22:41:05Z")
> [@ATPJD](#):
>
> if I could have our SSO integration also sign people out
Yes this is my strong pref and it is totally doable. When you sign out from sso you can make an API call to sign out the user.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 19, 2015, 10:44pm UTC](https://meta.discourse.org/t/session-timeout/34686/10 "2015-10-19T22:44:01Z")
Agree but it is a bit tricky.
We need to allow for “maximum session age” and “maximum session idle” … “maximum session idle” is way more interesting cause it will not cause all sorts of nasties like logging you out mid compose.
But, “maximum session idle” is a bit more expensive to implement. Additionally we need to make this work for “logout strict” and non “logout strict” so that gets tricky as well.
Overall this is can of worms I would like to hold off on opening.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 20, 2015, 12:22am UTC](https://meta.discourse.org/t/session-timeout/34686/11 "2015-10-20T00:22:34Z")
> [@ATPJD](#):
>
> My request for session time-out would be negated if I could have our SSO integration also sign people out. They are good about signing out of our primary intranet website. So far I’ve not been able to understand the sign-out discussion in the SSO thread.
I think this is a better avenue of approaching the problem…
---
### Author:  [@ATPJD](https://meta.discourse.org/u/ATPJD)
#### Post date: [October 20, 2015, 12:39am UTC](https://meta.discourse.org/t/session-timeout/34686/12 "2015-10-20T00:39:26Z")
I’m on board. Let’s close this thread if you like and I’ll start a new one seeking help with the SSO sign-out capability. Thanks for helping me focus on a good approach.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [October 20, 2015, 12:58am UTC](https://meta.discourse.org/t/session-timeout/34686/13 "2015-10-20T00:58:14Z")
I use a site-wide reverse proxy rule that keeps my users signed in.
Before every request (every 3 minutes) we verify if the session still valid. If it isn’t valid anymore (30 mins expire) we remove our cookies **and discourse cookies too**.
Could this approach help?
---
### Author:  [@ATPJD](https://meta.discourse.org/u/ATPJD)
#### Post date: [October 20, 2015, 12:30pm UTC](https://meta.discourse.org/t/session-timeout/34686/14 "2015-10-20T12:30:59Z")
> [@Falco](#):
>
> I use a site-wide reverse proxy rule that keeps my users signed in.
This sounds perfect, but a _site-wide reverse proxy rule_ is over my head. I Googled some resources to learn more. Thank you.
---
### Author:  [@Andy\_Rothfusz](https://meta.discourse.org/u/Andy_Rothfusz)
#### Post date: [October 21, 2015, 4:57pm UTC](https://meta.discourse.org/t/session-timeout/34686/15 "2015-10-21T16:57:27Z")
In the model where SSO does the Discourse log-out, how would I disable email notifications to the user and reenable them when they SSO-in again? I want to make sure that people who can’t SSO also can’t get notified of changes on the Discourse site.
---
### Author:  [@ramanbuttar](https://meta.discourse.org/u/ramanbuttar)
#### Post date: [April 27, 2016, 1:45am UTC](https://meta.discourse.org/t/session-timeout/34686/16 "2016-04-27T01:45:54Z")
What’s the default duration for session timeout in Discourse?
I’d also like to request this feature to expose the session duration setting in Discourse Site Settings.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [April 27, 2016, 2:04am UTC](https://meta.discourse.org/t/session-timeout/34686/17 "2016-04-27T02:04:57Z")
So I’m having some problems with this too :sadpanda:.
Would the team be open to a SiteSetting that changes the \_t cookie Expires from 20 years to Session?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 27, 2016, 2:09am UTC](https://meta.discourse.org/t/session-timeout/34686/18 "2016-04-27T02:09:02Z")
I support a site setting for this yes.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [April 27, 2016, 2:11am UTC](https://meta.discourse.org/t/session-timeout/34686/19 "2016-04-27T02:11:16Z")
Nice.
We’re having problems where people are sharing PCs on the company and posting on each other account :laughing:.
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [April 27, 2016, 4:02pm UTC](https://meta.discourse.org/t/session-timeout/34686/20 "2016-04-27T16:02:02Z")
Perhaps there should be a “Stay signed in” checkbox?
[Next page](https://meta.discourse.org/t/session-timeout/34686.md?page=2)