10

One of my clients' irritations is being logged out of the control panel when he has left his session idle for a few hours. How can I prevent this?

Improve this question
1
  • 2
    I'd be remiss if I didn't point out that it's a good thing your client is logged out after being idle (especially for several hours). It prevents baddies from accessing the site's control panel if, for example, your client's laptop is stolen. Site security should always be a top priority, and I'd recommend pointing that out to your client.
    – kmgdev
    Commented Nov 27, 2012 at 17:04

7 Answers 7

Reset to default
14

If for some reason you need to use sessions, you can change the session time with a config variable

http://ellislab.com/expressionengine/user-guide/general/hidden_configuration_variables.html#cp-session-ttl

$config['cp_session_ttl'] = 86400; // Keep admins logged in for one day!
Improve this answer
2
  • Tried this, cookies-only, login_reminder set to 'n', and am still getting logged out after some time (and getting the reminder). Could be b/c of having many tabs open for so long, trying in incognito mode right now to see if that's the issue.
    – notacouch
    Commented Feb 6, 2014 at 23:07
  • private browsing didn't help, found answer in this comment: expressionengine.stackexchange.com/a/19140/61
    – notacouch
    Commented Feb 7, 2014 at 21:34
10

Try changing the Control Panel Session type to Cookies Only: http://ellislab.com/expressionengine/user-guide/cp/admin/security_settings.html

Improve this answer
2

I use the following code within the config.php file that is located at /system/expressionengine/config/config.php.
And you have to set "cookies" in your security preferences.

// Cookie Settings
$config['cookie_prefix'] = "";
$config['cookie_domain'] = '.yourdomain.com';
$config['admin_session_type'] = 'c'; // if c does not work try 's' (session)

// logout time controlling: it's best to set only cookies in security prefs
// be sure to set cookies domain as well
$config['user_session_ttl'] = 14400; // user session
$config['cp_session_ttl'] = 14400;  // control panel session

This works quite well! Cheers outline4

Improve this answer
2

I'd prefer to just up vote MediaGirl's comment, but since I don't have enought rep yet to do that I'll just say that we did the two things recommended here: 1) switch to cookies only and 2) up the cp_session_ttl and that seems to have worked best for us. Probably didn't need to set both, but it worked regardless.

Improve this answer
3
  • Adam ask a question and you'll get some points action to start up-voting.
    – Richard Frank
    Commented Nov 27, 2012 at 21:27
  • Thanks Frank. I think I actually have a few that are sitting unanswered in the EE forums that maybe I'll move over here. ;)
    – Adam Christianson
    Commented Nov 27, 2012 at 21:30
  • Yeah I'm asking stock standard ones as well just to get this thing out of private beta. Although even the easy ones are actually producing very interesting answers...
    – Richard Frank
    Commented Nov 27, 2012 at 21:35
1

I was under the impression the staying logged-in problem was a known bug. As recently as 3 months ago complaints were still showing up on Ellis Labs official support forums, and that seemed to be the standard response.

Improve this answer
1
  • 1
    I have had intermittent problems with this as a bug, with CP sessions as cookies. In one instance it had to do with accessing two different EE installations on the same domain name (different subdomains). Logging into one would log the user out of the other.
    – Christy Collins
    Commented Nov 27, 2012 at 18:32
1

John D Wells mentioned this on his site, not me, but "as of EE 2.2.somethingorother, there are two new hidden configuration variables that allow you to control the session length of both CP users and front-end visitors. See User Session Length and Control Panel Session Length for more."

Here's a link to the "Hidden Configuration Variables" page: http://ellislab.com/expressionengine/user-guide/general/hidden_configuration_variables.html

Improve this answer
1
  • I see Richard Frank said basically the same thing, checking the "hidden config variables." Sorry for the duplicate info, but you may have luck trying both of the settings mentioned in John D Wells' post.
    – John Morton
    Commented Nov 27, 2012 at 18:54
1

This is somewhat tangential, but I highly recommend your client use something like 1password to manage credentials instead of staying logged in for a long time,

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.