60-minute default idle session timeout is waaaaaaay too short to be practical
Description
CSP Request Details
CSP Rejection Details
Potential Workaround
Checklist
hideActivity
Zak Burke 2 days ago
Respectfully, I disagree. I would support this stance if the 60m default had been carefully selected by the Security Group in consultation with POs/users to choose a good balance between security and functionality. But that is not what happened here. What happened is, I pulled 60m out of thin air and now we have a default value that is not functional. This ticket is not about loosening FOLIO’s security. It is about correcting a mistake.
Jens Heinrich 2 days ago
As this feature increases the security as a default the Security Group supports it and asks users requiring a lower security to update their configuration.
Using the secure value as default helps adaption of more secure settings.
Julian Ladisch March 6, 2025 at 3:19 PM
GBV want to keep the default of 1 hour for security reasons. GBV libraries make inventory bulk edits in the union catalog (not in FOLIO). GBV libraries don’t need a longer session timeout than 1 hour.
Details
Details
Assignee
Reporter
Labels
Priority
TBD
Summary: The 60-minute default value for idle-session timeout is too short to be practical, making normal operations such as data-import and bulk-edit impossible to perform because the UI times out in the middle of a job.
Expected behavior: Sessions last 7 days or longer.
Actual behavior: Sessions are terminated after 1 hour without activity.