OC5 beta2 - session timeout locks owncloud access only after trying to continue ownCloud usage

[j-ed]

From my understanding the session timeout has been introduced as a security mechanism to lock ownCloud access after a defined non-usage period. Unfortunately this function is only triggered if you want to continue to use ownCloud and not instantly after the time has been elapsed. This allows everyone to see the content currently displayed on the screen as long as a function within ownCloud is selected.
I would recommend to change the session timeout function in that way as online banking applications are doing it. A short time before the session timeout is reached, e.g.only 30s left, a message should be shown that the application will be locked if no interaction happens within the next 30s. After the session has been finaly been timed-out a redirect to the login page should happen automatically.
If possible a message should be shown above the login window statting that an automatic logout has been forced due to user inactivity.

[BernhardPosselt]

What do you mean by "only after trying to continue ownCloud usage"

[BernhardPosselt]

Possible relation to #527 ?

[j-ed]

What do you mean by "only after trying to continue ownCloud usage"

As explained before it is more or less how user expectations are
managed. If a session times out I would expect that a redirect to the
login page will happen so that it is clear that a logout has taken
place and that you have to reenter your credentials, similar as your
desktop screen will be locked after you've left your PC for a while.
If that redirect takes place in the moment you want to continue to
work it is noticed as a annoying and disturbing function and not as a
security feature.

[karlitschek]

Definitely a good idea but more an enhancement and not a bug.

[BernhardPosselt]

Problem is this section in lib/base.php

        // session timeout
        if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 3600)) {
            if (isset($_COOKIE[session_name()])) {
                setcookie(session_name(), '', time() - 42000, '/');
            }
            session_unset();
            session_destroy();
            session_start();
        }
        $_SESSION['LAST_ACTIVITY'] = time();

[BernhardPosselt]

That issue is bugging me a lot, i'll try to get a polling service up and running.

[BernhardPosselt]

Please reopen if the pull request didnt fix this