starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Reset LOGIN_TIMEOUT countdown on each web request #5169

New Issue
Closed
opened 2025-12-29 19:25:01 +01:00 by adam · 6 comments
adam commented 2025-12-29 19:25:01 +01:00
Owner
Copy Link

Originally created by @koratfood on GitHub (Aug 10, 2021).

Originally assigned to: @jeremystretch on GitHub.

NetBox version

v2.11.10

Feature type

Change to existing functionality

Proposed functionality

I would like to propose that we make LOGIN_TIMEOUT an inactivity timer (i.e. log out users who do not send any new requests before the timer runs out), instead of a "time since user last entered their credentials" timer which it currently is.

Based on a few simple web searches, I have found that this can be easily achieved by appending "SESSION_SAVE_EVERY_REQUEST = True" to settings.py (possibly via configuration.py and getattr to make it optional). Based on my own tests, this appears to make Netbox behave exactly as I prefer. However, I have no experience with Django, and I am not a developer. Thus, I am not sure whether this - should you find the change to be conceptually acceptable for Netbox - would be a sensible or acceptable implementation.

Use case

This would make it easier for admins to use a lower LOGIN_TIMEOUT value and thus log out inactive users, without the risk of bothering active users with re-authentication while they are actively working and navigating the UI.

Database changes

No response

External dependencies

No response

Originally created by @koratfood on GitHub (Aug 10, 2021). Originally assigned to: @jeremystretch on GitHub. ### NetBox version v2.11.10 ### Feature type Change to existing functionality ### Proposed functionality I would like to propose that we make LOGIN_TIMEOUT an inactivity timer (i.e. log out users who do not send any new requests before the timer runs out), instead of a "time since user last entered their credentials" timer which it currently is. Based on a few simple web searches, I have found that this can be easily achieved by appending "SESSION_SAVE_EVERY_REQUEST = True" to settings.py (possibly via configuration.py and getattr to make it optional). Based on my own tests, this appears to make Netbox behave exactly as I prefer. However, I have no experience with Django, and I am not a developer. Thus, I am not sure whether this - should you find the change to be conceptually acceptable for Netbox - would be a sensible or acceptable implementation. ### Use case This would make it easier for admins to use a lower LOGIN_TIMEOUT value and thus log out inactive users, without the risk of bothering active users with re-authentication while they are actively working and navigating the UI. ### Database changes _No response_ ### External dependencies _No response_
adam added the status: acceptedtype: feature labels 2025-12-29 19:25:01 +01:00
adam closed this issue 2025-12-29 19:25:01 +01:00
adam commented 2025-12-29 19:25:02 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Aug 10, 2021):

For context, NetBox's LOGIN_TIMEOUT configuration parameter is actually a wrapper around Django's SESSION_COOKIE_AGE setting. This controls the lifetime of the session cookie at the time of login, and it does not get updated until the cookie expires and the user is forced to re-authenticate by logging in again.

I have found that this can be easily achieved by appending "SESSION_SAVE_EVERY_REQUEST = True"

The impact of this is writing to the database or session file (depending on how NetBox is configured) on every request, whether or not any data has been modified. This can impose a significant performance impact in highly active deployments, so it's probably not something we want to turn on by default. Seems like the best route here would be a new configuration parameter to allow the admin to toggle the behavior.

@jeremystretch commented on GitHub (Aug 10, 2021): For context, NetBox's [`LOGIN_TIMEOUT`](https://netbox.readthedocs.io/en/stable/configuration/optional-settings/#login_timeout) configuration parameter is actually a wrapper around Django's [`SESSION_COOKIE_AGE`](https://docs.djangoproject.com/en/3.2/ref/settings/#session-cookie-age) setting. This controls the lifetime of the session cookie at the time of login, and it does not get updated until the cookie expires and the user is forced to re-authenticate by logging in again. > I have found that this can be easily achieved by appending "SESSION_SAVE_EVERY_REQUEST = True" The impact of this is writing to the database or session file (depending on how NetBox is configured) on _every_ request, whether or not any data has been modified. This can impose a significant performance impact in highly active deployments, so it's probably not something we want to turn on by default. Seems like the best route here would be a new configuration parameter to allow the admin to toggle the behavior.
adam commented 2025-12-29 19:25:02 +01:00
Author
Owner
Copy Link

@koratfood commented on GitHub (Aug 11, 2021):

I see. Thanks for helping me understand. Would be great to have it available as an option in configuration.py if that is acceptable.

@koratfood commented on GitHub (Aug 11, 2021): I see. Thanks for helping me understand. Would be great to have it available as an option in configuration.py if that is acceptable.
adam commented 2025-12-29 19:25:02 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Aug 12, 2021):

I think that is a reasonable change, and fairly simple to accomplish.

@DanSheps commented on GitHub (Aug 12, 2021): I think that is a reasonable change, and fairly simple to accomplish.
adam commented 2025-12-29 19:25:02 +01:00
Author
Owner
Copy Link

@koratfood commented on GitHub (Aug 12, 2021):

If this one gets accepted, please feel free to assign it to me, and I can post a PR. Thanks.

@koratfood commented on GitHub (Aug 12, 2021): If this one gets accepted, please feel free to assign it to me, and I can post a PR. Thanks.
adam commented 2025-12-29 19:25:02 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Aug 12, 2021):

What's the proposed configuration parameter name? SESSION_SAVE_EVERY_REQUEST seems a bit unwieldy IMO.

@jeremystretch commented on GitHub (Aug 12, 2021): What's the proposed configuration parameter name? `SESSION_SAVE_EVERY_REQUEST` seems a bit unwieldy IMO.
adam commented 2025-12-29 19:25:03 +01:00
Author
Owner
Copy Link

@koratfood commented on GitHub (Aug 12, 2021):

I agree. Here is a suggestion, including comments:

# Setting this to True will re-write users' login sessions on every page request, thus restarting the LOGIN_TIMEOUT
# countdown and relieving active users from re-authentication. This imposes a performance impact, and should be
# used with caution in highly active deployments.
KEEP_ACTIVE_USERS_LOGGED_IN = False

Or, to be slightly more technical about it, maybe KEEP_ACTIVE_SESSIONS_ALIVE ?
I find it hard to come up with a more self-explanatory parameter name without making it too verbose.

@koratfood commented on GitHub (Aug 12, 2021): I agree. Here is a suggestion, including comments: ``` # Setting this to True will re-write users' login sessions on every page request, thus restarting the LOGIN_TIMEOUT # countdown and relieving active users from re-authentication. This imposes a performance impact, and should be # used with caution in highly active deployments. KEEP_ACTIVE_USERS_LOGGED_IN = False ``` Or, to be slightly more technical about it, maybe `KEEP_ACTIVE_SESSIONS_ALIVE` ? I find it hard to come up with a more self-explanatory parameter name without making it too verbose.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#5169
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?