TimeOut Setting not being used in V9

[warrenbuckley]

Which exact Umbraco version are you using? For example: 8.13.1 - don't just write v8

9.0.0

Bug summary

When configuring the TimeOut setting for Umbraco backoffice the value is not used and I always stay logged in, no matter the value set.

Specifics

No response

Steps to reproduce

• Update AppSettings.json value
  Umbraco:CMS:Global:TimeOut to be "00:01:00"

• Login to Umbraco backoffice and leave it alone for one minute

• Expect to be logged out and shown login screen/prompt

Expected result / actual result

Shown the login/prompt screen after the timeout period set from configuration

---

This item has been added to our backlog AB#17349

[warrenbuckley]

This works fine in V8/dev with no issues when the config is set in the web.config
<add key="Umbraco.Core.TimeOutInMinutes" value="1" />

[warrenbuckley]

PR to fix this is here
#11351

[wicketbr]

I'm on 9.1.0 and I'm still seeing these timeout issues. No matter what I set in the appSettings.json file the BackOffice seems to be defaulting to a 15 minute inactivity timeout.

[wicketbr]

I should mention that when I first moved from 8.x to 9.0.0 the timeout worked as expected. It was something in a recent update that broke this and is frustrating my editors.

[wicketbr]

One last comment on this. If I set the timeout to be something lower than 15 minutes, say 1 minute, then the BackOffice session times out after 1 minute. However, if I set it to anything over 15 minutes it still seems to timeout after 15 minutes.

[wicketbr]

Any word on this? I'm still seeing this timeout problem even with a fresh install of the latest version of Umbraco. Also, the documentation states that the setting in appSettings.json for Umbraco.CMS.Global should be "TimeOut" in the format of "hh:mm:ss", but when I download the source for Umbraco it shows a setting of "TimeOutInMinutes" with a numerical value. In both cases, it seems like anything over the default 20 minutes is not being applied. I can set it lower than 20 minutes and I get signed out before the 20 minute default, but the override above 20 minutes does not appear to be working.

[bergmania]

Hi @wicketbr ..

Are you sure your timeout is not overridden anywhere? Did you check that it is actually the value to expect?

We use the value to set the CookieAuthenticationOptions.ExpireTimeSpan. Maybe also validate this has the expected value

[wicketbr]

Where can I check that? I'm running two separate instances of Umbraco. One is using the built-in BackOffice authentication and the other is using an OpenId authentication provider. Both have the timeout set in the appsettings.json file:

{
"Umbraco": {
"CMS": {
"Global": {
"TimeOut": "12:00:00",...

Where would this be getting overridden and where can I validate the actual value? I can send you the complete appsettings.json file if that would help with troubleshooting. It was working fine when I originally rolled out version 9, but somewhere during one of the updates my users started getting logged out at the 20 minute mark.

Thanks,

Brad

[bergmania]

You can only check this in code. E.g. by logging the value. This thing is, the appSettings.json values can be overridden in lot of placed (e.g. appSetting.{Environment}.json, or environment variables)

[bergmania]

If you can reproduce on a clean umbraco setup, then it is definitely a bug, and should have its own issue here on github.

[poornimanayar]

I can reproduce this in a vanilla install. I set the TimeOut to 08:00:00 in appSettings and backoffice logged me out in about 16mins

[creativesuspects]

I also have this issue on 9.3.1. TimeOut is set to 01:00:00, but I get logged out after roughly 15-20 minutes.

[nikolajlauridsen]

A fix for this has been merged in #12029 and will be released in 9.4.0 😄

[creativesuspects]

A fix for this has been merged in #12029 and will be released in 9.4.0 😄

Thanks! I forgot to check linked issue #11965.