increasing session timeout

[9年前 に Sagar P によって更新されました。]

Hi

How to change the session expiration time in liferay 6.1.

Because in 6.1 we will defining session timeout in 2 places.
in D:\liferay-portal-6.1.2-ce-ga3\tomcat-7.0.40\webapps\ROOT\WEB-INF\web.xml
and other in portal-ext.properties file session.timeout property.

what is difference?
Because as in doc
# Specify the number of minutes before a session expires. This value is
# always overridden by the value set in web.xml.
#
session.timeout=30

I want to set session time out to 4 hrs.
please help.Its urgent??

Thanks

[9年前 に Vishal Patel によって更新されました。]

Hi,
Just comment out the entry from web.xml. and set your time in portal-ext.properties.

Give it a try.

[9年前 に Sagar P によって更新されました。]

Hi

commenting in the sense..its the core file of liferay.
To change any core liferay files we have to use ext plugin rite??

anyway am trying what u said.

will be updating soon.

Thanks for the reply.

[9年前 に Sagar P によって更新されました。]

Hi vishal

I commented out what u said in web.xml.
and set the value of session.timeout=2.

It worked ie session got expired.
Thanks

one question i have is..in \liferay-portal-6.1.2-ce-ga3\tomcat-7.0.40\conf
there is also web.xml file in that also session tag is there.can u please tell me difference???

Thanks

[9年前 に Vishal Patel によって更新されました。]

Hi Sagar,

Without commenting in Liferay's web xml, It would also work. I never added any ext for extending the session time out from web.xml. It always worked with setting in portal-ext.properties in my cases.

About the value in tomcat's web.xml, It will not be effective once we set the value from portal-ext properties or directly from Liferay core's web.xml (Its my opinion only!!).

[9年前 に Olaf Kock によって更新されました。]

Note that there are different session timeouts:

• Tomcat times out sessions after a given time, e.g. 30 minutes.
• Liferay times out sessions after the time configured in session.timeout

IMHO (I'd love to be proven the opposite):

If you configure tomcat to time out a session after 30 minutes and Liferay to 2 minutes, the session will be terminated by Liferay if a browser is still open. If you start a session, then close the browser, the session will live for 30 minutes - when tomcat terminates it.

If you configure Tomcat and Liferay to time out after 2 minutes, the session will time out after two minutes every time, through whatever mechanic comes first.

If you configure tomcat to time out after 2 minutes, but Liferay to time out after 10 minutes, tomcat will terminate the session after 2 minutes, while Liferay's JS code will try to terminate it again after 10 minutes, naturally not having any effect on the old session. If you also are using Liferay's timeout warning, Liferay will start warning you after 9 minutes that the session (that tomcat long terminated) will expire in 1 minute (e.g. in minute 10)).

Tomcat's configuration is done in web.xml - either the webapp's or tomcat's global configuration in the conf/ directory. Liferay's configuration is done in portal-ext.properties.

[9年前 に Vishal Patel によって更新されました。]

Thanks olaf , Its really knowledgeable and important.

[9年前 に Sagar P によって更新されました。]

Hi Olaf ,

Thank you for the information.

I want to increase the defualt session time out.
I commented <session-config> tag in webapps/root/webinf/ web.xml file and added the property session.timeout=45 in ext properties file.

But session is getting expired for 30 mins only.

Please tell me correct approach to extend the session.

Thanks waiting for your reply.

[9年前 に Olaf Kock によって更新されました。]

If you comment out the session timeout in web.xml, tomcat's defaults will be valid. I don't know what the default is, but it might be 30 minutes. So you don't want to comment it in web.xml, rather set it to 45 in addition to Liferay's configuration.

[9年前 に Sagar P によって更新されました。]

Thank you very much for the reply Olaf.

I will give a try as you said.

will update you soon.

Thanks

[9年前 に Sagar P によって更新されました。]

setting the session timeout to 45 in addition to liferay's configuration is not working.
session gets expire after 30 mins itself.

But if it set to smaller values like 5 min it gets expire after 5 min.
think for larger values its not working.

can please tell me any other ways of increasing or changing the session timeout.

Thanks

[9年前 に Jack Bakker によって更新されました。]

Sagar, is it possible you are running Tomcat through Liferay IDE ?

under 'Servers' check the session-timeout in the web.xml there

[9年前 に Sagar P によって更新されました。]

Jack, no am not using any IDE's

[9年前 に mohiden abdul kader によって更新されました。]

Sagar P:

setting the session timeout to 45 in addition to liferay's configuration is not working.
session gets expire after 30 mins itself.

But if it set to smaller values like 5 min it gets expire after 5 min.
think for larger values its not working.

can please tell me any other ways of increasing or changing the session timeout.

Thanks

Hi sagar ,


Previously I have configured in the properties files and xml file.But It wont worked. I have tweak to increased the session timeout in the jspf file located in the following path

liferay-portal-6.2.0-ce-ga2/tomcat-7.042/webapps/ROOT/html/common/themes/session_timeout.jspf

sessionLength: session timeout value,


Thanks,
Abdul Kader

[9年前 に Sagar P によって更新されました。]

mohiden abdul kader:

Sagar P:

setting the session timeout to 45 in addition to liferay's configuration is not working.
session gets expire after 30 mins itself.

But if it set to smaller values like 5 min it gets expire after 5 min.
think for larger values its not working.

can please tell me any other ways of increasing or changing the session timeout.

Thanks

Hi sagar ,


Previously I have configured in the properties files and xml file.But It wont worked. I have tweak to increased the session timeout in the jspf file located in the following path

liferay-portal-6.2.0-ce-ga2/tomcat-7.042/webapps/ROOT/html/common/themes/session_timeout.jspf

sessionLength: session timeout value,


Thanks,
Abdul Kader

Hi Abdul ,

Thanks for the reply.
Do you mean to say by using Hooks we have to modify the session_timeout.jspf file.
Is it enough changing the sessionLength variable to required value like sessionLenth:45 sometime like that.
are do we have to make some more changes in order to make it work.

Please do reply.Waiting

Thanks

[9年前 に Olaf Kock によって更新されました。]

If you inspect that file and find anything hardcoded - e.g. anything other than reading the configured values - then yes. I've looked at the file and it's properly reading the configured values (in the version that I've checked), so: No, you don't need a JSP Hook to override this. Just configure correctly and the values will be read.

Why does it look like it didn't work? There are other places where you can get a default setting. E.g. tomcat has a global setting in conf/web.xml and I'm not sure about precedence. You might run into tomcat's global maximum of 30 minutes that you can't extend locally in your app (e.g. in Liferay) but you'll have to check this for yourself.

Another option is to not change any duration but just set session.timeout.auto.extend=true - this way Liferay's JS code will extend the session indefinitely, as long as a browser is still open. You'll need to hint how long your appserver's sessions are, but the defaults of 30 minutes are typically fine.

[9年前 に Eswaran R によって更新されました。]

hi friends ....

i am using portlet page but tomcat session timeout 30 min ...
so portlet page session timeout ..
how to increase session timeout in portlet page ...

"Warning! Due to inactivity, your session has expired. Please save any data you may have entered before refreshing the page."

how to solve ....???
kindly help me...

Regards ...
Eswaran.R

[9年前 に David H Nebinger によって更新されました。]

You can use Liferay.Session.extend() javascript method to keep the session alive from the browser side.

[9年前 に Azhar md によって更新されました。]

Hi David,

i have put this code in my js.. but the problem is after 30 min when i refresh or open my account it redirects me login page

function extendSession(){
		 try { if ('noWarning' == mySessionRenewAtWarning()) { mySessionRenew(); } } catch(e) {} 
		 }
		 
		 //Closes the warning by invoking the click event of extend button...
		 
		 function mySessionRenewAtWarning(){
		     var jqryWarn = new jQuery;
		    var warnElm = jqryWarn.find('.popup-alert-notice');
		    if (warnElm.length > 0) {
		        // Match content of warning with session expiration warning language
		        if (Liferay.Language.get('warning-your-session-will-expire').indexOf(warnElm[0].firstChild.nodeValue) == 0) {
		            // click the extend button
		            warnElm.find('.popup-alert-close').click();
		            return true;
		        }
		    }
		    return "noWarning";
		}
		
		// Extends the session and resets the client timer
		function mySessionRenew() {
		    if (Liferay.Session._stateCheck) {
		        window.clearTimeout(Liferay.Session._stateCheck);
		        Liferay.Session._stateCheck = null;
		    }
		    Liferay.Session.autoExtend = true;
		    Liferay.Session.extend();
		}

:

[9年前 に David H Nebinger によって更新されました。]

Azhar md:

i have put this code in my js.. but the problem is after 30 min when i refresh or open my account it redirects me login page

Um, because your JS is crap or because you don't really have anything in here that triggers the invocation, i.e. some sort of javascript timer?

Trust me, invoking Liferay.Session.extend() works. If it's not working for you, it's because you're just not invoking it.

[9年前 に Azhar md によって更新されました。]

Trust me, invoking Liferay.Session.extend() works. If it's not working for you, it's because you're just not invoking it.

I know i am not invoking how does it gets invoke kindly expalin that part

[9年前 に David H Nebinger によって更新されました。]

It normally does not get invoked. Normally users click something on the page which causes a submit to the portal at which point the session will get extended.

But for those cases where you cannot submit (i.e. if you had, say, a full ajax portlet or for some reason the user just sits there and looks at the page for a period exceeding the normal timeout), you can invoke Liferay.Session.extend() on the browser side to keep the session live. You can do this using a javascript timer or as a result of event handling (i.e. focus changing if it's some big form that takes over 30 mins to complete).

In any case, it is up to you to invoke it.

[9年前 に Azhar md によって更新されました。]

Hi David ,
That was really a nice explanation..
Can we only extend on ajax calls??
Is there a normal way where we can extend when a user clicks for some button data is fetched and session timer gets restarted..
Correct me if am wrong..

Thanks,.

[9年前 に Eswaran R によって更新されました。]

hi,,
thanks to reply,,,

my question is ..

my portlet page idle session timeout but now i am using portlet page at the time session timeout ....


how to solve it ????;;;

[9年前 に Eswaran R によって更新されました。]

my portlet page using at the time session timeout...

how to solve this error ????

my portlet page idle session timeout but now i am using portlet page at the time session timeout ....

[7年前 に Suryakant Panda によって更新されました。]

I am relatively new to Liferay. Currently, each of our applications in the Liferay portal have their own timeout settings in respective web.xml.
Hence users have problem when they switch between applications.

The expectation is to have common timeout settings for all the applications and should keep all the applications alive in one session as long as user is active in any app.

In other words, if I open a new browser session, open 2 applications in 2 tabs and work on app #1 for long time, app #2 should not timeout as I am still active in app #1.

I tried putting the session.timeout in portal-ext.properties file and commenting out app specific web.xml settings. Also tried putting in tomcat web.xml under conf but doesn't work.

Any help please ?

Thanks,

[7年前 に Olaf Kock によって更新されました。]

Suryakant Panda:

I am relatively new to Liferay. Currently, each of our applications in the Liferay portal have their own timeout settings in respective web.xml.
Hence users have problem when they switch between applications.

Welcome to Liferay.

First of all: When you say that users "switch applications" you're obviously not talking about portlet applications, but plain web applications that happen to run on the same server as Liferay - right? They can't be configured through Liferay and need to be synchronized (in configuration and session timeouts) manually. You can achieve this by not configuring any timeout for all your applications individually, rather use tomcat's global web.xml (in conf/) and configure your desired value there.

And if you're relying on working on one app, while being inactive in the other app (still talking about classic webapps, not portlet apps): This is how it works. The sessions are for individual apps.

Liferay has a setting that can extend the session for as long as there's an open browser. Check session.timeout.auto.extend in portal-ext.properties. Naturally this only works in Liferay, not in independent web applications.

Now if you'd convert your independent web applications to portlet applications, they'd all follow Liferay's timeout. Alternatively you could configure them all to use a Single-Sign-On system - while your sessions might time out, you'd at least still be (re-)logged in.

And, last but not least: Next time remember that after more than a year since the last post in a thread, it's worth opening a new one - especially if it's a long thread like this one. If it provides significant reference, link to it.

[7年前 に Suryakant Panda によって更新されました。]

Thank you Olaf.
Yes, they are independent web applications under one liferay. Currently each application has it's own timeout in web.xml. I tried removing them and putting in just conf/web.xml. That provides the global timeout setting for all the applications but still they time out independently, even if I am active in one app, clock starts for other applications.

Session.timeout.auto.extend works but for security reasons I can't use that.

As you recommended, either I have to move them to portal applications or use Single Sign On, we currently use CAS for login. Is it possible to keep other application's session active while working on one? Any pointers?

Thank you!

[7年前 に Olaf Kock によって更新されました。]

Suryakant Panda:

Is it possible to keep other application's session active while working on one? Any pointers?

You might be able to implement a custom Tomcat SessionManager that does the trick. The only problem is: You won't have any clue which sessions belong to the same client: IP addresses aren't unique in times of NAT and, by design, no app sends the cookies for the other apps because they're all separated by the application context's name. This implementation might have unwanted side effects and introduce vulnerabilities (e.g. session identifiers that need to be transmitted in URLs and end up in logs) - especially as you mention security reasons for not being able to keepalive sessions with the browser.

A hacky way (don't tell anyone that you have it from me) is to include a resource, e.g. an image, from each application - which will be loaded on every pageload. Ugly and creates interdependencies and technical debt, but gets the job done.

Best maintainable, cleanest implementation: Implement your application stateless and implement SSO - so your users can be transparently re-logged in in case their session expired.

[7年前 に Suryakant Panda によって更新されました。]

Will try stateless application with SSO.

Thank you Olaf, appreciate your suggestions !