web: idle timeout for browser sessions #276

closed cmc opened this on 2026-09-28 04:33 UTC · security web

Discussion

cmc 2026-09-28 04:33 UTC

Web sessions last 7 days from login with no idle timeout and no renewal (internal/httpd/accounts.go, CreateWebSession(..., 7*24*time.Hour)). A session left open on a shared machine stays valid for the week.

Idle timeout (e.g. 12 h without a request), renewing the expiry on use.
Keep the absolute cap.
Show last-used time in web sessions list.

referenced in commit 4e0958a163 by cmc: plans: open issues from the architecture and UX reviews

2026-09-28 05:43 UTC

referenced in commit 08a7e44095 by cmc: changelog: the unreleased lead names the session idle timeout

2026-09-28 21:49 UTC

closed by cmc in commit 0ff41e58be: web: sessions list shows last use; docs for the idle timeout

2026-09-28 21:49 UTC

referenced in commit a6f7827f2e by cmc: store: web sessions lapse after 12 hours idle, under the absolute cap

2026-09-28 21:49 UTC