Extend client session idling time from 5 to 20 minutes

Documentation is updated as well corretly stating that the session is now configured to last 30 minutes since user inactivity
globaleaks · Oct 5, 2024 · efb9c04 · efb9c04
1 parent 2254520
commit efb9c04
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/client/app/src/app.module.ts b/client/app/src/app.module.ts
@@ -135,7 +135,7 @@ export class AppModule implements OnDestroy {
   }
 
   initIdleState() {
-    this.idle.setIdle(300);
+    this.idle.setIdle(1500);
     this.idle.setTimeout(300);
     this.keepalive.interval(30);
     this.idle.setInterrupts(DEFAULT_INTERRUPTSOURCES);

diff --git a/documentation/security/ApplicationSecurity.rst b/documentation/security/ApplicationSecurity.rst
@@ -102,7 +102,7 @@ Session Management
 ------------------
 The session implementation follows the `OWASP Session Management Cheat Sheet <https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html>`_ security guidelines.
 
-The system assigns a session to each authenticated user. The Session ID is a 256-bit long secret generated randomly by the backend. Each session expires according to a timeout of 60 minutes. Session IDs are exchanged between the client and the backend via a header (`X-Session`) and expire as soon as users close their browser or the tab running GlobaLeaks. Users can explicitly log out via a logout button or implicitly by closing the browser.
+The system assigns a session to each authenticated user. The Session ID is a 256-bit long secret generated randomly by the backend. Each session expires according to a timeout of 30 minutes. Session IDs are exchanged between the client and the backend via a header (`X-Session`) and expire as soon as users close their browser or the tab running GlobaLeaks. Users can explicitly log out via a logout button or implicitly by closing the browser.
 
 Session Encryption
 ------------------