3

The internal rules regarding how long users can stay logged into the CP have undergone numerous changes in the last few version of EE (mainly 2.7.x onward I think). Various config overrides were introduced and then removed again, and the Docs make reference to some changes that are not listed in the change log. So I'm getting a bit lost in what is current and what is not. Specifically:

We used to have cp_session_ttl and user_session_ttl available. Now the documentation mentions that they have been replaced in v2.8, apparently with expire_session_on_browser_close (see: documentation). But the change log for 2.8 makes no mention of expire_session_on_browser_close, in fact as far as I can see it doesn't appear anywhere on the change log page. And this expire_session_on_browser_close config setting does not seem to do quite the same job as the two variables in any case.

And there is also the matter that apparently there was a setting hardcoded into the system to log people out after being idle for a certain amount of time, which was unaffected by either of the two (now deprecated?) config variables.

So my question is: as of the current version (2.9.2) what is the method to control how long a user can stay logged into the CP before being booted out? Is it even possible?

(I'm particularly interested because I keep most of my config variables in a separate file (as per Focus Labs masterConfig system) so the system upgrades of EE don't necessarily remove/rewrite deprecated variables as they might otherwise do if all my config settings were inside the system folder).

Improve this question

1 Answer 1

Reset to default
1

I wrote an answer to a related question a couple of days back on here: CP Session Timeout - no Solution?

That probably provides the info you need, but in short I referenced, as you have, that the previously usable session time variable $config['cp_session_ttl'] looks to have been deprecated, which allowed for custom login session lengths.

Solution suggested was setting $config['cp_session_type'] = 'c'; in your config.php, which will trigger an option on next login to tick 'Auto login on future visits?' - this should then provide you with a 2 week persistent login, that remains logged in even when the browser is closed.

Hope that helps!

Improve this answer
5
  • That's helpful Ben. To be honest, I wasn't looking to solve any particular problem with this question, just to try and gain clear information regarding what config overrides relating to session times and logouts are and are not now considered 'canon' in the current version of EE, in addition to what other factors might be in play in this regard -- a subject that one would think would be simple enough to look up, but which the documentation and the change log, between them, have managed to entirely muddy. Your other post certainly throws some light into a few of the dark corners.
    – RickL
    Feb 23, 2015 at 21:29
  • Thanks Rick - yes agreed, the changelogs and docs can be particularly intimidating coming into the EE and CT systems part way along the journey - often you'll think you've found an answer when scouring forums and stackexchange, only to see the technique has now been deprecated. We've recently inherited an existing developed site, and maintaining/upgrading areas of that where you throw some homebrew code in the mix is certainly a headscratcher at times! Glad my own experience of the login situation shed some light somewhat.
    – Ben Coleman
    Feb 23, 2015 at 21:47
  • I'm not sure that I find them intimidating; just perplexingly inconsistent. The docs mention certain overrides being deprecated in, say, 2.8, and replaced with some new config variable. Look at the change log of 2.8 and there is no mention of the change, and the config variable stated by the docs to be a replacement is not mentioned anywhere on the entire change log page. Vexing.
    – RickL
    Feb 23, 2015 at 21:57
  • Indeed - I've given thought to launching some sort of assistance site that basically lists the updates/changelogs for EE (and probably Cartthrob given much of my ongoing EE development with it) - and then employs a traffic light highlighting system, based on whether it's 'all good', some caveats, or simply not there/doesn't work! I fear I'd need a few more like minds to help keep such a task up to date though... :)
    – Ben Coleman
    Feb 23, 2015 at 22:31
  • Marking Ben's reply as the answer because it largely covers the ground that I was looking to get a clearer grip on.
    – RickL
    Mar 18, 2015 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.