I have posted about this question before, and am puzzled that no one seems to know the answer. Maybe I used a misleading thread subject in some way, so here's a new go at finding the answer to this:
When a user doe not tick the "remember me" box, and is inactive, meaning they do not click anything - after what time do they get logged out of their session? Or do they not get logged out at all?
And, most importantly, where can I change the setting for the duration of that session timeout?
I really, really need to limit session times. If you know more about this, please share...
Cheers,
Matt
AdminCP > Configurations > Who's Online > and the "Cut-off Time (mins)" options is responsible for login sessions.
I want to set a time after which, if inactive, a user actually gets kicked out of their session, so that they need to log in again if they want to do something.
I'm pretty sure that's not what that setting is doing. That only sets the time after which users do not get shown as online anymore in the "who's online" display.
Actually, out of sheer desperation, I even just tried it now: That setting does most definitely not define the session timeout.
Matt
Seriously? No one knows?
And no one wants to know either?
Am I really the only one who would like to be able to define the time after which an inactive user gets logged out? No one wants to know how to minimise chances that a user's account gets taken over simply because they didn't log off on a shared or public computer?
I would like to hear especially what big board owners think about this, and how they handle it...
If I have somehow upset someone and that's the reason no one is answering, please let me know! That's not my intention, I simply want to find a solution...
Matt
(2012-02-13, 08:26 AM)Mariku Wrote: [ -> ]When a user doe not tick the "remember me" box, and is inactive, meaning they do not click anything - after what time do they get logged out of their session? Or do they not get logged out at all?
And, most importantly, where can I change the setting for the duration of that session timeout?
So, the answers to these questions seem to be:
=> Users do never get logged out unless they close their browser or delete the forum cookies from their browser.
=> There is no way at this time to set a forced logout for inactive users.
To achieve that, a core edit is necessary. I have not figured out exactly how to do that best yet, although with serious help from more knowledgeable people than me I am getting closer. For more details, see this thread:
http://community.mybb.com/thread-113435.html
If you can help with achieving a forced user logout after a certain time of inactivity, please go to that thread and let us know!
Cheers,
Matt