# SessionExpirytime not working as expected, can we force the session logout on browser exit.?

**URL:** <https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864>\
**Category:** General\
**Created:** [15 November 2023 01:31 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864 "2023-11-15T01:31:25Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![smanjunath211](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/smanjunath211/32/95742_2.png) [@smanjunath211](https://discourse.nodered.org/u/smanjunath211)\
**Post date:** [15 November 2023 01:31 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864/1 "2023-11-15T01:31:25Z")

</div>

any way we can force the session logout on browser exit ?  
somehow sessionexpiry has no effect. i put 60 seconds , but even if someone opens editor it allows without authentication.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [15 November 2023 10:52 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864/2 "2023-11-15T10:52:10Z")

</div>

Can you show us what you have in settings.js (include some of the surrounding lines for context).  
Have you restarted node-red?  
If you logout are you then forced to login?  
Having logged out and in again does the 60 seconds now work?

Also please stop node-red and start it again in a command window and post the full output here. Copy/paste, not screenshot please.

---

<div class="post-metadata">

**Author:** ![smanjunath211](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/smanjunath211/32/95742_2.png) [@smanjunath211](https://discourse.nodered.org/u/smanjunath211)\
**Post date:** [15 November 2023 11:14 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864/3 "2023-11-15T11:14:53Z")

</div>

```auto
    /** To password protect the Node-RED editor and admin API, the following
     * property can be used. See http://nodered.org/docs/security.html for details.
     */

    adminAuth: {
        type: "credentials",
        users: [{
            username: "admin",
            password: "$2b$08$fXJDzY8ovPAcNYk9e/x/6eNKFpEM3Iw.oUGY2TrU87DZ5sz1c/1E2",
            permissions: "*",
	sessionExpiryTime:60,
        }]
    },

    //adminAuth: {
    // type: "credentials",
    // users: [{
    // username: "admin",
    // password: "$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN.",
    // permissions: "*"
    // }]
    //},

```

Yes I have started node-red (restarted the window service)

Yes, if I logout, then on re-opening editor session, it does ask for password.

startup log

```auto
15 Nov 16:38:52 - [info] 

Welcome to Node-RED
===================

15 Nov 16:38:52 - [info] Node-RED version: v3.0.0
15 Nov 16:38:52 - [info] Node.js version: v16.16.0
15 Nov 16:38:52 - [info] Windows_NT 10.0.19045 x64 LE
15 Nov 16:38:54 - [info] Loading palette nodes
15 Nov 16:38:57 - [info] Dashboard version 3.6.1 started at /ui
15 Nov 16:38:59 - [info] Settings file : c:\Users\OEEHo\NR-NR-Reports\settings.js
15 Nov 16:38:59 - [info] HTTP Static : c:\temp > /
15 Nov 16:38:59 - [info] Context store : 'memoryOnly' [module=memory]
15 Nov 16:38:59 - [info] Context store : 'file' [module=localfilesystem]
15 Nov 16:38:59 - [info] User directory : c:\Users\OEEHo\NR-NR-Reports
15 Nov 16:38:59 - [warn] Projects disabled : set editorTheme.projects.enabled=true to enable
15 Nov 16:38:59 - [info] Flows file : c:/users/oeeho/nr-nr-reports/flows.json
15 Nov 16:38:59 - [info] Server now running at http://127.0.0.1:1886/
15 Nov 16:38:59 - [warn] 

```

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/c/8/c8a6618c53fcb1ef9fa4d2a17b45730cbe90669b.png)

closing browser and after 90 seconds...directly opens the editor

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/3/2/3238e61726e547dea0f4955c7f75606408a9a7d9.png)

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [15 November 2023 11:35 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864/4 "2023-11-15T11:35:46Z")

</div>

Try deleting the file c:/users/oeeho/nr-nr-reports/.sessions.json

---

<div class="post-metadata">

**Author:** ![smanjunath211](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/smanjunath211/32/95742_2.png) [@smanjunath211](https://discourse.nodered.org/u/smanjunath211)\
**Post date:** [15 November 2023 11:50 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864/5 "2023-11-15T11:50:48Z")

</div>

No effect,

newly created file .session.json contains this info

```auto
{"xMpGaCilHtenLgCFaUSGR5TdWDpmrCeQWI0dDXyuQuYOkVFOeLYo3TfXJYHIwkIP+q1ADC0/gXdvvdyzYNVP03dd+fqbkx3C/HTbrNXWu+dHjgkXAkQtxOaOPtiXsaLhrkgzdA694ZLy9KVo7WH+YqJ4MLciE+dh0WMuCgQQCj4=":{"user":"admin","client":"node-red-editor","scope":"*","accessToken":"xMpGaCilHtenLgCFaUSGR5TdWDpmrCeQWI0dDXyuQuYOkVFOeLYo3TfXJYHIwkIP+q1ADC0/gXdvvdyzYNVP03dd+fqbkx3C/HTbrNXWu+dHjgkXAkQtxOaOPtiXsaLhrkgzdA694ZLy9KVo7WH+YqJ4MLciE+dh0WMuCgQQCj4=","expires":1700653499764}}

```

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [15 November 2023 11:55 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864/6 "2023-11-15T11:55:12Z")

</div>

> [@smanjunath211](#):
>
> `1700653499764`

Feeding that into [https://www.epochconverter.com/](https://www.epochconverter.com/) shows that is in 7 days, so it looks like the 60 is not working.

I suggest updating to the latest node-red (3.1.0) as there were a number of bugs in the first 3.0 release.

However, I don't think this will do what you want anyway, as I _think_ you would have to log in again every 60 seconds, which is probably not desirable.

---

<div class="post-metadata">

**Author:** ![smanjunath211](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/smanjunath211/32/95742_2.png) [@smanjunath211](https://discourse.nodered.org/u/smanjunath211)\
**Post date:** [15 November 2023 11:59 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864/7 "2023-11-15T11:59:45Z")

</div>

60 seconds was just an arbitrary number, i would keep it to my comfort.  
will try updating to NR 3.1.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [15 November 2023 12:48 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864/8 "2023-11-15T12:48:42Z")

</div>

You have put the `sessionExpiryTime` inside the `users` array object. It should be in the `adminAuth` object itself.

You cannot set different session times for different users.

---

<div class="post-metadata">

**Author:** ![smanjunath211](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/smanjunath211/32/95742_2.png) [@smanjunath211](https://discourse.nodered.org/u/smanjunath211)\
**Post date:** [15 November 2023 14:19 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864/9 "2023-11-15T14:19:12Z")

</div>

Aha!

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/a/1/a1afe16c9433cfec18f694a15022e1c54cac1b59.png)

```auto
 /** To password protect the Node-RED editor and admin API, the following
     * property can be used. See http://nodered.org/docs/security.html for details.
     */

    adminAuth: {
	sessionExpiryTime:60,
        type: "credentials",

        users: [{
            username: "admin",
            password: "$2b$08$fXJDzY8ovPAcNYk9e/x/6eNKFpEM3Iw.oUGY2TrU87DZ5sz1c/1E2",
            permissions: "*",

        }]

    },

   

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [29 November 2023 14:19 UTC](https://discourse.nodered.org/t/sessionexpirytime-not-working-as-expected-can-we-force-the-session-logout-on-browser-exit/82864/10 "2023-11-29T14:19:17Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.