48

In Magento 1.x the backend session timeout was set via:
Backend -> System -> Configuration -> Admin -> Security -> Session Lifetime (seconds)

Initially, my question was how to set this in Magento 2.0, but apparently there are differences between Magento 2.0 and Magento 2.1

For Magento 2.0: Arkadii Chyzhov has pointed out how to set this (see below).

For Magento 2.1: fschmengler has suggested a solution (see below).

However, M 2.1 appears not to provide a straightforward solution via the backend. Can anybody come up with an additional solution for M 2.1?

76

Stores > Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds)

Also there is a possibility to set this parameter directly to database, just put a value under path

admin/security/session_lifetime

in the table core_config_data

Update

Magento 2.1 admin cookie life time = Stores > Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds) or till the user closes the browser

Since Magento 2.1 introduces lifetime for admin cookie as "expires on browser close", together with value in Stores >Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds). That means, that session life time equals value in Stores > Settings > Configuration > Advanced > Admin > Security > Admin Session Lifetime (seconds) or when a browser is closed.

Or you can set up a new value for admin cookie, like it is proposed in fschmengler's answer

  • would you be interested in adjusting the functionality of the layered navigation on our M2 website? – Els den Iep Jul 13 '16 at 13:51
  • @ElsdenIep pls. find my contact information in the profile – Arkadii Chyzhov Jul 27 '16 at 19:51
  • Do you know what is the column in the database for that value, so I can change it programmatically? – jojman Aug 16 '16 at 16:57
  • I've set it to be 50400 but it still logs out after around 20 mins.... – OZZIE Sep 13 '16 at 14:18
  • @ArkadiiChyzhov see my answer below :) – OZZIE Sep 14 '16 at 14:30
14

Check attached image screenshot for better understanding of admin process.

Go to Stores->Settings->Configuration->Advanced->Admin->Security->Admin Session Lifetime (seconds)

And check screenshot. enter image description here

10

Solution for Magento 2.1+

Since Magento 2.1 the admin session lifetime is always "session", i.e. until the browser is closed. This has been might have been introduced for security reasons.

The relevant code is in Magento\Backend\Model\Session\AdminConfig:

/**
 * Set session cookie lifetime to session duration
 *
 * @return $this
 */
protected function configureCookieLifetime()
{
    return $this->setCookieLifetime(0);
}

If you want to change this behavior, you can add a plugin for this class with the following interceptor method:

public function beforeSetCookieLifetime()
{
    $lifetime = $this->scopeConfig->getValue(
        \Magento\Framework\Session\Config::XML_PATH_COOKIE_LIFETIME,
        \Magento\Framework\App\Config\ScopeConfigInterface::SCOPE_TYPE_DEFAULT);
    return [$lifetime, \Magento\Framework\Session\Config::COOKIE_LIFETIME_DEFAULT];
}

Where $this->scopeConfig should be an instance of \Magento\Framework\App\Config\ScopeConfigInterface, injected via constructor parameter.

This way the cookie lifetime is used from configuration, just as in the frontend.

Note that the configuration in Stores > Configuration > Advanced > Admin Security > Session Lifetime does not have any effect on the cookies anymore! It is used to determine Redis session lifetime, so if you increase the cookie lifetime, you should also increase this value.

  • I am wondering if you could explain this security reason. From my point of view, setting admin cookie lifetime to 0, brings discrepancy and not obvious behavior, if we are using 'admin/security/session_lifetime', which defines admin session life time, and which depends from 2.1 on cookie lifetime implicitly. – Arkadii Chyzhov Sep 15 '16 at 22:33
  • 1
    I assumed it is to prevent the case that an admin closes the window without "log out" and the any person getting access to the same pc is already logged in. This is not a major threat and I agree with you that it's a bad decision to make this "feature" this non obvious. – Fabian Schmengler Sep 16 '16 at 6:56
  • But I searched for the responsible commit now and found this: github.com/magento/magento2/commit/… " MAGETWO-49092: Invalid Form Key on Admin login page" - it sounds more like a workaround to hide another bug with a more or less accidental and at least undocumented side effect. – Fabian Schmengler Sep 16 '16 at 6:57
  • There must be more going on, because my session is still expiring without closing my browser. – Matt Cosentino Nov 29 '16 at 19:55
  • 1
    @Volvox look carefully: the plugin is for setCookieLifetime, a public method with parameters – Fabian Schmengler May 18 '17 at 11:35
6

A note here, the accepted answer works however magento 2 uses the default php folder to store session files, if you have this configured in php:

09,39 *     * * *     root   [ -x /usr/lib/php/sessionclean ] && /usr/lib/php/sessionclean

then this is added to the system cron by the php installation.

So then you can either

  • disable that cron
  • or better: increase gc_maxlifetime in php.ini (as this will be the upper limit)
3

Another solution without modifing any settings is install any auto refresh addon for your browser and set its time (60 seconds).

It will auto refresh the page for every 6o seconds which prevents session lifetime to expire and we can start working on another tab.

I used Easy Auto Refresh and it works fine for me.

2

If you are using multiple VMs / servers for web and db and the time is not sync also caused the issue.

So if all options above does not work, check the time stamp / date of the two severs when you are using multiple server for web and db.

1

I don't know why but for some of us setting the Admin Session Lifetime from backend doesn't work, so I found a couple of solutions:

  1. In php.ini change session.gc_maxlifetime from 1440 to whatever number of seconds you desire. (This solution worked for me, tested on magento 2.2.0 and 2.2.1)

  2. In .htaccess add "php_value session.gc_maxlifetime 28800" or to whatever number of seconds you desire.

  3. By manually setting the lifetime. Go to vendor/magento/module-encryption-key/etc/config.xml and change from 900s to whatever number of seconds you desire.

Hope one of this solutions will work for others too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.