Feature Request: Add Session timeout

[daboss3d]

Add Session timeout
It would be nice if we can define the session timeout, (globally or by user)

[karthikeyan-29]

Hi dadboss3d,
I'm interested in working on this issue. Could you please assign it to me?

[gorkem-bwl]

Hi dadboss3d,
I'm interested in working on this issue. Could you please assign it to me?

Sure. Please let us know your implementation steps for FE/BE. Many thanks!

[karthikeyan-29]

Thank you. Here’s how I plan to implement session timeout:

• Backend (Node.js – Express + JWT):
• Set a global timeout using an environment variable (e.g., SESSION_TIMEOUT_MINUTES).
• Use this value when generating JWTs (expiresIn) to enforce session duration.
• Existing middleware will reject expired tokens.
• Add per-user session timeout support based on a field in the user record.

Frontend (React + Vite):

• Decode the JWT on login using jwt-decode to extract exp (expiration).
• Set a setTimeout to auto-logout users after the session expires.
• Optionally display a warning 1 minute before expiration.

Let me know if you'd prefer a different approach like token blacklisting or DB session store. Otherwise, I’ll proceed with this plan.

[ajhollid]

@daboss3d @karthikeyan-29 tokens already expire after a set period that is user configurable, am I missing something here?

Default token expiration is 2 hours.

TOKEN_TTL is the relevant env var to set to specify how long you want your tokens to be valid for.

[karthikeyan-29]

@daboss3d @karthikeyan-29 tokens already expire after a set period that is user configurable, am I missing something here?

Default token expiration is 2 hours.

TOKEN_TTL is the relevant env var to set to specify how long you want your tokens to be valid for.

You're right — TOKEN_TTL controls the token expiration on the backend (currently 2 hours), and that part is working as expected.

However, what I noticed is that on the frontend, the token expiry isn’t being tracked after login. The token is stored in Redux, but the app doesn’t auto-logout the user when the token expires, which could lead to cases where a user thinks they are still authenticated when the token is no longer valid.

I can handle this by:

• Decoding the token using jwt-decode

• Setting a setTimeout() based on the exp claim to automatically log out the user

• Optionally showing a warning a few minutes before expiry

Let me know if that sounds good, and I’ll implement it.

[ajhollid]

Let me discuss this with the front end team and get back to you on details.

I'm not primarily a front end guy so I'd like to gather their input here.

I will touch base as soon as I have talked with them 🙏 thanks for your patience and interest!

[karthikeyan-29]

Sure ! I will wait for you response and Thanks for the update

[ajhollid]

Hi @karthikeyan-29 ,

Thanks for your patience here, after discussion and consideration I'm not convinced setting a timeout is the best approach here.

I think a more robust solution here would be to implement a refresh token system since we are working with tokens anyways.

This is a significantly more complex task though that will need to be carefully planned and documented before starting work. I imagine it would probably be best split between 2 or 3 pull requests. If you're interested in working on it feel free to come up with a proposal and we can discuss.

If it's more than you'd like to take on right now then no problem, we will add it to our TODO and assign team members as opportunities come up!

[karthikeyan-29]

@ajhollid
Thank you for the feedback. I agree that implementing a refresh token system is a more secure and scalable solution.

Here's my proposed approach:

• Introduce short-lived access tokens (e.g., 15 minutes) and long-lived refresh tokens (e.g., 7–14 days).
• On login, issue both tokens. Access tokens will be used for authorization; refresh tokens will be securely stored in HttpOnly cookies.
• When the access token expires, the frontend will call a /refresh-token endpoint to obtain a new access token.
• Implement refresh token rotation and store them in the database for added security and session tracking.
• Support token revocation (e.g., on logout or suspicious activity) and optional multi-device session management.

I plan to split this into multiple pull requests:
Core refresh token generation and handling
Token rotation and validation endpoint
Optional session revocation and tracking features

Please let me know if you'd like me to proceed with the first phase.

[ajhollid]

Hi @karthikeyan-29 ,

Thanks for your proposal and your interest in the project, however I don't have the available hours at the moment to do such a thorough overhaul of the auth system. Auth is mission criticial obviously, so we need to have comprehensive oversight. We can table this issue for now and add it to our TODO for when we have more dev hours to commit to this.

Thanks again!