Proactively Invalidate Sessions After Defined Durations
The glide.active.session.timeout.invalidate.session property controls whether a timeout session is proactively invalidated before the Tomcat server.
When glide.active.session.timeout.invalidate.session isn't set to true, there’s a small interval of time where a timed-out session isn’t invalidated proactively before the Tomcat container invalidates the session. The duration of this time interval is dependent on additional properties representing differing use cases.
| Property | Description |
|---|---|
| glide.ui.active.session.life_span | The value of this property defines the time, in minutes, before a UI session is invalidated. |
| glide.guest.active.session.life_span | The value of this property defines the time, in minutes, before a guest session is invalidated. |
| glide.integrations.active.session.life_span | The value of this property defines the time, in minutes, before an integrations session is invalidated. |
Ensure that the property glide.active.session.timeout.invalidate.session is set to true.
More information
| Attribute | Description |
|---|---|
| Configuration name |
|
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | false |
| Fallback value | false |
| Category | Session management |
| Security risk | - Severity score: 4.6 - CVSS score: Medium - Security risk details: If a session is hijacked, an attacker may be able to use a session during this small period. |
| Dependencies and prerequisites | None |
Parent Topic:Session management