[Zope] Session Timeout Troubles

[Sale, Robin]

Andreas, thank you for replying.

Actually, the problem I have is the reverse - the sessions NEVER seem to
time out. I have a directive from up on high to make it so that 15
minutes of inactivity within any location on the site (All of which is
password protected under acl_users or acl_users(group aware) setup.) It
seems like no matter what I do to the session-timeout-minutes value in
zope.conf, as long as the user keeps their browser open, they can
continue to use the site even if they are idle for an hour or more... I
have the session-timeout-minutes set to 15 and have set the
session-resolution-seconds value to 20 seconds as well and restarted
Zope and yet it seems to not make a difference.

Thank you,
Robin

=====================================
Robin Sale, Software Engineer
Specialized Technology Resources, Inc.
10 Water Street
Enfield CT 06082-4899 USA
robin.sale at strus.com


-----Original Message-----
From: zope-bounces at zope.org [mailto:zope-bounces at zope.org] On Behalf Of
Andreas Jung
Sent: Thursday, January 25, 2007 10:08 AM
To: Sale, Robin; zope at zope.org
Subject: Re: [Zope] Session Timeout Troubles



--On 25. Januar 2007 09:59:44 -0500 "Sale, Robin" <Robin.Sale at strus.com>

wrote:

> Hi,
>
> We're using Zope 2.8.8 with a bunch of client sites set up in various
> sub directories / databases. We're using ZEO for the database storage
> and a local zodb file for the temporary data.
>
> I've recently been asked to set the system to user sessions time out
> after 15 minutes of activity. I've changed the setting in our
zope.conf
> file (the session timeout value) and restarted zope. However, if I
open
> a page on the site that requires logon and log in, then leave the
> browser alone for 15 or 20 minutes or even an hour, when I click on a
> link, it doesn't force me to re-authenticate... it just works as
normal.

You can configure the session timeout and the max. number of session 
objects. Perhaps you have more user sessions than configured so some 
sessions might be deleted before the timeout?


Andreas