0

Had a request from Infosec to enforce a 15 min session timeout. Have configured it on the org-wide settings, have additionally configured it on the profile level. Still, after 15 mins, test user can happily continue to work in Salesforce.

What else could I be missing in enforcing this timeout?

  • did you enable "Force logout on session timeout" Session Security Settings – glls Aug 7 '17 at 13:46
  • Also worth checking: View and Edit Session Timeout Settings in Profiles – glls Aug 7 '17 at 13:47
  • Yes, force logout is enabled – Rob Cowell Aug 7 '17 at 13:51
  • 1
    maybe an installed package is keeping the users session active? (via requests or something?) – glls Aug 7 '17 at 13:54
  • 1
    for starters, you can check the users browser console, see if any requests are sent while the session is active (browser dev tools) – glls Aug 7 '17 at 14:02
1

Session time outs only occur when the user doesn't do anything for the specified time window. If a user is "happily working" in salesforce, they're doing something, and so they won't be timed out. If they go away for a lunch break, they should come back to find that their session has expired and they must log in again.

Note that it is possible for developers to define code that allows a session to stay active indefinitely. For example, if a developer were to put an actionPoller in a Visualforce page, and the user walked away, their Visualforce session would remain active as long as that page was open. When possible, developers should avoid writing code that may make an otherwise inactive session remain viable.

  • Yup, that's what we're expecting to see. Tester deliberately leaving browser alone for more than the specified 15 mins, then they come back to it and continue like nothing happened. Cos nothing happened. – Rob Cowell Aug 7 '17 at 15:55
  • Re: edit relating to ActionPoller - pretty sure we don't have any, but I'll do a full metadata sweep just in case. – Rob Cowell Aug 7 '17 at 15:56
  • 2
    @RobCowell Granted, it may not be an actionPoller (that's just an example), but consider going to the browser's "Console" (F12), and watch the Network tab for any activity. – sfdcfox Aug 7 '17 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.