Force Autologout ( Remote session (X2go) + Browser)

[Denny Fuchs]

hi,

I have the problem, that need to explicit logout or close the tab, to close the session. If I have forgotten it, than the session is still login, after hours/days for ever.
Is there way to force a logout, after X seconds when nobody clicks on the site?

cu denny

 

[dcsapak]

hi,

what exactly is the use case for this? you still have to login to your x2go session, so it is as safe as the x2go login?
also, if we would implement a timeout, you still would be vulnerable (to what exactly?) if someone logs in while you are logged in?

 

[Denny Fuchs]

hi,

it is a requirement from PCI, like the frontend from a firewall. The reason could, if you leave your computer and forgot to logout, anyone could do things (also accidentally) . Yes, that it is my fault ... but it is usefull in some scenaries.
Is it so complicated, to bring a timeout into the webinterface ? It would be great to a have a timeout

cu denny

 

[dcsapak]

mhmm ok,

a timeout in general is not that difficult, what is hard is how to determine "idle" behaviour, we continuously make api requests in the background, and checking if you click/move over something would be much work

 

[Denny Fuchs]

hi,

it was working a while ago, I think. I had to relogin and if I searching the forum for session timeout, I find also threads (but he opposite: how to disable the timeout ;-) ).

cu denny

 

[dcsapak]

can you open a feature request at https://bugzilla.proxmox.com its easier to track and discuss there (you also get an update if someone implements it)

 

[Denny Fuchs]

hi,

done: https://bugzilla.proxmox.com/show_bug.cgi?id=1310