In Magento 1.x the backend session timeout was set via:
Backend -> System -> Configuration -> Admin -> Security -> Session Lifetime (seconds)

Initially, my question was how to set this in Magento 2.0, but apparently there are differences between Magento 2.0 and Magento 2.1

For Magento 2.0: Arkadii Chyzhov has pointed out how to set this (see below).

For Magento 2.1: fschmengler has suggested a solution (see below).

However, M 2.1 appears not to provide a straightforward solution via the backend. Can anybody come up with an additional solution for M 2.1?

8 Answers 8


Stores > Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds)

Also, there is a possibility to set this parameter directly to the database, just put a value under the path


in the table core_config_data


Magento 2.1 admin cookie life time = Stores > Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds) or till the user closes the browser

Since Magento 2.1 introduces lifetime for admin cookie as "expires on browser close", together with value in

Stores >Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds)

That means, that session lifetime equals the value in

Stores > Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds)

or when a browser is closed.

Or you can set up a new value for admin cookie like it is proposed in fschmengler's answer

  • would you be interested in adjusting the functionality of the layered navigation on our M2 website? Commented Jul 13, 2016 at 13:51
  • @ElsdenIep pls. find my contact information in the profile Commented Jul 27, 2016 at 19:51
  • Do you know what is the column in the database for that value, so I can change it programmatically?
    – jojman
    Commented Aug 16, 2016 at 16:57
  • 1
    I've set it to be 50400 but it still logs out after around 20 mins....
    – OZZIE
    Commented Sep 13, 2016 at 14:18
  • @ArkadiiChyzhov see my answer below :)
    – OZZIE
    Commented Sep 14, 2016 at 14:30

Check attached image screenshot for better understanding of admin process.

Go to Stores->Settings->Configuration->Advanced->Admin->Security->Admin Session Lifetime (seconds)

And check screenshot. enter image description here


Solution for Magento 2.1+

Since Magento 2.1 the admin session lifetime is always "session", i.e. until the browser is closed. This has been might have been introduced for security reasons.

The relevant code is in Magento\Backend\Model\Session\AdminConfig:

 * Set session cookie lifetime to session duration
 * @return $this
protected function configureCookieLifetime()
    return $this->setCookieLifetime(0);

If you want to change this behavior, you can add a plugin for this class with the following interceptor method:

public function beforeSetCookieLifetime()
    $lifetime = $this->scopeConfig->getValue(
    return [$lifetime, \Magento\Framework\Session\Config::COOKIE_LIFETIME_DEFAULT];

Where $this->scopeConfig should be an instance of \Magento\Framework\App\Config\ScopeConfigInterface, injected via constructor parameter.

This way the cookie lifetime is used from configuration, just as in the frontend.

Note that the configuration in Stores > Configuration > Advanced > Admin Security > Session Lifetime does not have any effect on the cookies anymore! It is used to determine Redis session lifetime, so if you increase the cookie lifetime, you should also increase this value.

  • I am wondering if you could explain this security reason. From my point of view, setting admin cookie lifetime to 0, brings discrepancy and not obvious behavior, if we are using 'admin/security/session_lifetime', which defines admin session life time, and which depends from 2.1 on cookie lifetime implicitly. Commented Sep 15, 2016 at 22:33
  • 1
    I assumed it is to prevent the case that an admin closes the window without "log out" and the any person getting access to the same pc is already logged in. This is not a major threat and I agree with you that it's a bad decision to make this "feature" this non obvious. Commented Sep 16, 2016 at 6:56
  • But I searched for the responsible commit now and found this: github.com/magento/magento2/commit/… " MAGETWO-49092: Invalid Form Key on Admin login page" - it sounds more like a workaround to hide another bug with a more or less accidental and at least undocumented side effect. Commented Sep 16, 2016 at 6:57
  • There must be more going on, because my session is still expiring without closing my browser. Commented Nov 29, 2016 at 19:55
  • 1
    @Volvox look carefully: the plugin is for setCookieLifetime, a public method with parameters Commented May 18, 2017 at 11:35

A note here, the accepted answer works however magento 2 uses the default php folder to store session files, if you have this configured in php:

09,39 *     * * *     root   [ -x /usr/lib/php/sessionclean ] && /usr/lib/php/sessionclean

then this is added to the system cron by the php installation.

So then you can either

  • disable that cron
  • or better: increase gc_maxlifetime in php.ini (as this will be the upper limit)

I don't know why but for some of us setting the Admin Session Lifetime from backend doesn't work, so I found a couple of solutions:

  1. In php.ini change session.gc_maxlifetime from 1440 to whatever number of seconds you desire. (This solution worked for me, tested on Magento 2.2.0 and 2.2.1)

  2. In .htaccess add "php_value session.gc_maxlifetime 28800" or to whatever number of seconds you desire.

  3. By manually setting the lifetime. Go to vendor/magento/module-encryption-key/etc/config.xml and change from 900s to whatever number of seconds you desire.

I hope one of these solutions will work for others too.


Another solution without modifying any settings is to install any auto-refresh addon for your browser and set its time (60 seconds).

It will auto-refresh the page for every 60 seconds which prevents session lifetime to expire and we can start working on another tab.

I used Easy Auto Refresh and it works fine for me.

  • dont be silly with such "solutions". its totally unacceptable.
    – sellio
    Commented Jun 28, 2019 at 17:31
  • 1
    It is acceptable if you can't change the settings on your server becaues your hoster does not allow it.
    – Black
    Commented Jan 24, 2020 at 9:51

If you are using multiple VMs / servers for web and DB and the time is not synced also caused the issue.

So if all options above do not work, check the time stamp/date of the two severs when you are using multiple servers for web and DB.


To determine the current value of the session.gc_maxlifetime PHP directive on your server, use the phpinfo() function

enter image description here

Need change from php.ini or something else.. shows the path to the php.ini file that was used (see below). That will be the file to edit. enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.