Magento 2 backend session timeout

Question

In Magento 1.x the backend session timeout was set via:
Backend -> System -> Configuration -> Admin -> Security -> Session Lifetime (seconds)

Initially, my question was how to set this in Magento 2.0, but apparently there are differences between Magento 2.0 and Magento 2.1

For Magento 2.0: Arkadii Chyzhov has pointed out how to set this (see below).

For Magento 2.1: fschmengler has suggested a solution (see below).

However, M 2.1 appears not to provide a straightforward solution via the backend. Can anybody come up with an additional solution for M 2.1?

Answer 1

Stores > Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds)

Also, there is a possibility to set this parameter directly to the database, just put a value under the path

admin/security/session_lifetime

in the table core_config_data

Update

Magento 2.1 admin cookie life time = Stores > Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds) or till the user closes the browser

Since Magento 2.1 introduces lifetime for admin cookie as "expires on browser close", together with value in

Stores >Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds)

That means, that session lifetime equals the value in

Stores > Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds)

or when a browser is closed.

Or you can set up a new value for admin cookie like it is proposed in fschmengler's answer

Answer 2

Check attached image screenshot for better understanding of admin process.

Go to Stores->Settings->Configuration->Advanced->Admin->Security->Admin Session Lifetime (seconds)

And check screenshot.

Answer 3

Solution for Magento 2.1+

Since Magento 2.1 the admin session lifetime is always "session", i.e. until the browser is closed. This has been might have been introduced for security reasons.

The relevant code is in Magento\Backend\Model\Session\AdminConfig:

/**
 * Set session cookie lifetime to session duration
 *
 * @return $this
 */
protected function configureCookieLifetime()
{
    return $this->setCookieLifetime(0);
}

If you want to change this behavior, you can add a plugin for this class with the following interceptor method:

public function beforeSetCookieLifetime()
{
    $lifetime = $this->scopeConfig->getValue(
        \Magento\Framework\Session\Config::XML_PATH_COOKIE_LIFETIME,
        \Magento\Framework\App\Config\ScopeConfigInterface::SCOPE_TYPE_DEFAULT);
    return [$lifetime, \Magento\Framework\Session\Config::COOKIE_LIFETIME_DEFAULT];
}

Where $this->scopeConfig should be an instance of \Magento\Framework\App\Config\ScopeConfigInterface, injected via constructor parameter.

This way the cookie lifetime is used from configuration, just as in the frontend.

Note that the configuration in Stores > Configuration > Advanced > Admin Security > Session Lifetime does not have any effect on the cookies anymore! It is used to determine Redis session lifetime, so if you increase the cookie lifetime, you should also increase this value.

Answer 4

A note here, the accepted answer works however magento 2 uses the default php folder to store session files, if you have this configured in php:

09,39 *     * * *     root   [ -x /usr/lib/php/sessionclean ] && /usr/lib/php/sessionclean

then this is added to the system cron by the php installation.

So then you can either

• disable that cron
• or better: increase gc_maxlifetime in php.ini (as this will be the upper limit)

Answer 5

I don't know why but for some of us setting the Admin Session Lifetime from backend doesn't work, so I found a couple of solutions:

1. In php.ini change session.gc_maxlifetime from 1440 to whatever number of seconds you desire. (This solution worked for me, tested on Magento 2.2.0 and 2.2.1)

2. In .htaccess add "php_value session.gc_maxlifetime 28800" or to whatever number of seconds you desire.

3. By manually setting the lifetime. Go to vendor/magento/module-encryption-key/etc/config.xml and change from 900s to whatever number of seconds you desire.

I hope one of these solutions will work for others too.

Answer 6

Another solution without modifying any settings is to install any auto-refresh addon for your browser and set its time (60 seconds).

It will auto-refresh the page for every 60 seconds which prevents session lifetime to expire and we can start working on another tab.

I used Easy Auto Refresh and it works fine for me.

Answer 7

If you are using multiple VMs / servers for web and DB and the time is not synced also caused the issue.

So if all options above do not work, check the time stamp/date of the two severs when you are using multiple servers for web and DB.

Answer 8

To determine the current value of the session.gc_maxlifetime PHP directive on your server, use the phpinfo() function

Need change from php.ini or something else.. shows the path to the php.ini file that was used (see below). That will be the file to edit.