10

One of my clients' irritations is being logged out of the control panel when he has left his session idle for a few hours. How can I prevent this?

  • 2
    I'd be remiss if I didn't point out that it's a good thing your client is logged out after being idle (especially for several hours). It prevents baddies from accessing the site's control panel if, for example, your client's laptop is stolen. Site security should always be a top priority, and I'd recommend pointing that out to your client. – kmgdev Nov 27 '12 at 17:04
14

If for some reason you need to use sessions, you can change the session time with a config variable

http://ellislab.com/expressionengine/user-guide/general/hidden_configuration_variables.html#cp-session-ttl

$config['cp_session_ttl'] = 86400; // Keep admins logged in for one day!
| improve this answer | |
  • Tried this, cookies-only, login_reminder set to 'n', and am still getting logged out after some time (and getting the reminder). Could be b/c of having many tabs open for so long, trying in incognito mode right now to see if that's the issue. – notacouch Feb 6 '14 at 23:07
  • private browsing didn't help, found answer in this comment: expressionengine.stackexchange.com/a/19140/61 – notacouch Feb 7 '14 at 21:34
10

Try changing the Control Panel Session type to Cookies Only: http://ellislab.com/expressionengine/user-guide/cp/admin/security_settings.html

| improve this answer | |
2

I use the following code within the config.php file that is located at /system/expressionengine/config/config.php.
And you have to set "cookies" in your security preferences.

// Cookie Settings
$config['cookie_prefix'] = "";
$config['cookie_domain'] = '.yourdomain.com';
$config['admin_session_type'] = 'c'; // if c does not work try 's' (session)

// logout time controlling: it's best to set only cookies in security prefs
// be sure to set cookies domain as well
$config['user_session_ttl'] = 14400; // user session
$config['cp_session_ttl'] = 14400;  // control panel session

This works quite well! Cheers outline4

| improve this answer | |
2

I'd prefer to just up vote MediaGirl's comment, but since I don't have enought rep yet to do that I'll just say that we did the two things recommended here: 1) switch to cookies only and 2) up the cp_session_ttl and that seems to have worked best for us. Probably didn't need to set both, but it worked regardless.

| improve this answer | |
  • Adam ask a question and you'll get some points action to start up-voting. – Richard Frank Nov 27 '12 at 21:27
  • Thanks Frank. I think I actually have a few that are sitting unanswered in the EE forums that maybe I'll move over here. ;) – Adam Christianson Nov 27 '12 at 21:30
  • Yeah I'm asking stock standard ones as well just to get this thing out of private beta. Although even the easy ones are actually producing very interesting answers... – Richard Frank Nov 27 '12 at 21:35
1

I was under the impression the staying logged-in problem was a known bug. As recently as 3 months ago complaints were still showing up on Ellis Labs official support forums, and that seemed to be the standard response.

| improve this answer | |
  • 1
    I have had intermittent problems with this as a bug, with CP sessions as cookies. In one instance it had to do with accessing two different EE installations on the same domain name (different subdomains). Logging into one would log the user out of the other. – Christy Collins Nov 27 '12 at 18:32
1

John D Wells mentioned this on his site, not me, but "as of EE 2.2.somethingorother, there are two new hidden configuration variables that allow you to control the session length of both CP users and front-end visitors. See User Session Length and Control Panel Session Length for more."

Here's a link to the "Hidden Configuration Variables" page: http://ellislab.com/expressionengine/user-guide/general/hidden_configuration_variables.html

| improve this answer | |
  • I see Richard Frank said basically the same thing, checking the "hidden config variables." Sorry for the duplicate info, but you may have luck trying both of the settings mentioned in John D Wells' post. – John Morton Nov 27 '12 at 18:54
1

This is somewhat tangential, but I highly recommend your client use something like 1password to manage credentials instead of staying logged in for a long time,

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.