This proposal has been implemented

Reviewed by @product and accepted in the main project
Funded by Mainio Tech
Developed by Mainio Tech
Available in release 0.24 via in #7282

[Security] Automatically sign out user after certain period of time

AH 04/02/2021 14:11 Finished

**Is your feature request related to a problem? Please describe.**

Currently we have the possibility to configure "timeout_in" time which closes the session at Decidim's side after a certain period of inactivity. This is fine, as long as we don't have any external sign in options which also need their own sign out flows during the sign out from Decidim.

Another issue is that the user is not informed that their session is about to expire and it may come as a surprise that they were signed out.

**Describe the solution you'd like**

We'd like to have these changes to the session termination:

E.g. 1-2 minutes before the session is about to expire, the user should be shown a session expiration modal which states that their session is about to expire.
If the user wants, they could extend their session by clicking a button from that window.
When the session is automatically terminated, send the user to the normal sign out flow so that the user is also signed out from any external services that could be possibly configured for the sign out flow through Omniauth.
After the user is signed out automatically, show a special message that explains the user what happened, so they are not left wondering what just happened.

**Describe alternatives you've considered**

As mentioned, the alternative to this is already part of Devise but it does not take into consideration the external services' sign out flows. Also, the user experience is not greatest as the user will not get clear information about what happened and why.

**Additional context**

Similar concepts to what is proposed can be seen e.g. in online banking. This is an important feature when we provide strong authentication to the users as other people could possibly use their credentials if they did not sign out from the service.

**Does this issue could impact on users private data?**

Yes, this has a positive impact on users private data. Implementing these features keeps the user more secure.

**Funded by**

Mainio Tech

Comment

Filter results for category: Older Releases

Fingerprint

The piece of text below is a shortened, hashed representation of this content. It is useful to ensure the content has not been tampered with, as a single modification would result in a totally different value.

Value: bd2a8ca6c11f8afb9764859665548779ba87a6a9a44e338432089a08485370d0

Source:

{"body":{"en":"<p><strong>**Is your feature request related to a problem? Please describe.**</strong></p><p>Currently we have the possibility to configure \"timeout_in\" time which closes the session at Decidim's side after a certain period of inactivity. This is fine, as long as we don't have any external sign in options which also need their own sign out flows during the sign out from Decidim.</p><p>Another issue is that the user is not informed that their session is about to expire and it may come as a surprise that they were signed out.</p><p><strong>**Describe the solution you'd like**</strong></p><p>We'd like to have these changes to the session termination:</p><ul><li>E.g. 1-2 minutes before the session is about to expire, the user should be shown a session expiration modal which states that their session is about to expire.</li><li>If the user wants, they could extend their session by clicking a button from that window.</li><li>When the session is automatically terminated, send the user to the normal sign out flow so that the user is also signed out from any external services that could be possibly configured for the sign out flow through Omniauth.</li><li>After the user is signed out automatically, show a special message that explains the user what happened, so they are not left wondering what just happened.</li></ul><p><strong>**Describe alternatives you've considered**</strong></p><p>As mentioned, the alternative to this is already part of Devise but it does not take into consideration the external services' sign out flows. Also, the user experience is not greatest as the user will not get clear information about what happened and why.</p><p><strong>**Additional context**</strong></p><p>Similar concepts to what is proposed can be seen e.g. in online banking. This is an important feature when we provide strong authentication to the users as other people could possibly use their credentials if they did not sign out from the service.</p><p><strong>**Does this issue could impact on users private data?**</strong></p><p>Yes, this has a positive impact on users private data. Implementing these features keeps the user more secure.</p><p><strong>**Funded by**</strong></p><p>Mainio Tech</p>"},"title":{"en":"[Security] Automatically sign out user after certain period of time"}}

This fingerprint is calculated using a SHA256 hashing algorithm. In order to replicate it yourself, you can use an MD5 calculator online and copy-paste the source data.

Essential

Preferences

Analytics and statistics

Marketing

[Security] Automatically sign out user after certain period of time

Please log in

Cookie settings

Essential

Preferences

Analytics and statistics

Marketing

[Security] Automatically sign out user after certain period of time

Confirm

Please log in

Share