# Adding session expiry for user using custom authentication

**URL:** <https://discourse.nodered.org/t/adding-session-expiry-for-user-using-custom-authentication/18266>\
**Category:** General\
**Created:** [22 November 2019 06:41 UTC](https://discourse.nodered.org/t/adding-session-expiry-for-user-using-custom-authentication/18266 "2019-11-22T06:41:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![akvish](https://avatars.discourse-cdn.com/v4/letter/a/82dd89/32.png) [@akvish](https://discourse.nodered.org/u/akvish)\
**Post date:** [22 November 2019 06:41 UTC](https://discourse.nodered.org/t/adding-session-expiry-for-user-using-custom-authentication/18266/1 "2019-11-22T06:41:14Z")

</div>

I have implemented a custom authentication for node red using user-authentication.js file and mentioned it inside the setting.js file. I used the below documentation page  
[Securing Node Red](https://nodered.org/docs/user-guide/runtime/securing-node-red)  
It is working fine. Now I want to implement a session timeout of 30 min for the users. How can I do that?  
I have multiple users. Can I have a different session time out for different users?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [22 November 2019 17:39 UTC](https://discourse.nodered.org/t/adding-session-expiry-for-user-using-custom-authentication/18266/2 "2019-11-22T17:39:49Z")

</div>

Not sure, but don't forget that a lot of node-red communications happen over websockets and not http. With the ws(s) protocol, the only time you have access to the headers is on initial connection. After that, the connection is "upgraded" from http to ws.

So if you want any really session security, you will need to ensure that you have a way of blocking ws comms after a period of inactivity.