Timeline for Magento 2 backend session timeout
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 18, 2017 at 11:35 | comment | added | Fabian Schmengler |
@Volvox look carefully: the plugin is for setCookieLifetime, a public method with parameters
|
|
| May 18, 2017 at 11:08 | comment | added | Volvox |
How this works? I'm new to M2, but AFAIK you cannot create plugin for protected functions, and before plugin can only affect parameters, but configureCookieLifetime does not uses any.
|
|
| Nov 29, 2016 at 19:55 | comment | added | Matt Cosentino | There must be more going on, because my session is still expiring without closing my browser. | |
| Sep 16, 2016 at 7:01 | history | edited | Fabian Schmengler | CC BY-SA 3.0 |
remove bold assumption
|
| Sep 16, 2016 at 6:57 | comment | added | Fabian Schmengler | But I searched for the responsible commit now and found this: github.com/magento/magento2/commit/… " MAGETWO-49092: Invalid Form Key on Admin login page" - it sounds more like a workaround to hide another bug with a more or less accidental and at least undocumented side effect. | |
| Sep 16, 2016 at 6:56 | comment | added | Fabian Schmengler | I assumed it is to prevent the case that an admin closes the window without "log out" and the any person getting access to the same pc is already logged in. This is not a major threat and I agree with you that it's a bad decision to make this "feature" this non obvious. | |
| Sep 15, 2016 at 22:33 | comment | added | Arkadii Chyzhov | I am wondering if you could explain this security reason. From my point of view, setting admin cookie lifetime to 0, brings discrepancy and not obvious behavior, if we are using 'admin/security/session_lifetime', which defines admin session life time, and which depends from 2.1 on cookie lifetime implicitly. | |
| Sep 15, 2016 at 19:27 | history | answered | Fabian Schmengler | CC BY-SA 3.0 |