Session timeouts

Question

I am trying to test session timeouts.

I note that the minimum timeout setting is 15 minutes. Is there any way to get this lower?

Also, if I have a dev session open with eclipse and hit save on a file and the same user is logged in with browser using the application but has not clicked anything in the browser for 20 minutes and then clicks something will his session be timedout if he has been saving some files in eclipse during the last 20 minutes.

Answer 1

There are a couple of methods via the Partner API that can be used to end active Sessions.

1. logout()
   

   "Ends the session of the logged-in user."

2. invalidateSessions()
   "Ends one or more sessions specified by a sessionId."

Using these with your current Salesforce Session Id will kick out both users logged in via a web browser and those active via the API.

You can grab the session Id from an active web session with anonymous apex in the developer console:

String sessionID = UserInfo.getSessionId();
System.debug(sessionID);

I tried the following test:

1. Login via the web interface
2. Get the Session Id as above
3. Use the Session Id to connect via the Partner API
4. Call logout via the Partner API
5. Attempting to reconnect with the prior Session Id via the Partner API results in a INVALID_SESSION_ID (as expected)
6. Clicking on the home tab in the web interface redirects to the login page.

So, if you are sharing the same session id you definitely logout all users who are using it. You can use this to simulate a Session timeout by invalidating a session

However, if you establish a session directly via the Partner API using stored credentials you get a different session Id to a user who logged in via the web interface.

Eclipse will be using a different Session Id to users who logged in via the web interface. Also, I suspect that if Eclipse encounters an invalid session response it will just re-establish a new session with the stored credentials and carry on transparently to the user.

Answer 2

1. I suspect you could simulate the session expiry by deleting/modifying the session cookie from your browser, that would give you an invalid session response from Salesforce. You cannot lower the validity to any less than what Salesforce offers in the UI AFAIK.

2. No. It's two entirely different sessions. Although it is possible to take a Session ID you discover via Visualforce and re-use it on an API call that you code yourself (or if you used the REST API with curl from a command line), either of those would keep your session alive.

Answer 3

Do not think you can change beyond the settings possible. And this is for all users, so no subsettings for portal/authenticated site users.

Setup > Security controls > Session Settings.

The browser timeout is probably by cookies while eclipse is sessionless and authenticates on every metadata api call. This wouldn't impact your browser session.