Can i set the session expire time for admin or normal user?

Developer help
1

Our Security Team found a security vulnerability on my blog(ghost).

After login by admin user, there is not any action(idle) for long time. But the login session be maintained.

Can i set the session expire time for admin or normal user?

2

Try this on config.production.json for 2 days expire.

"spam": {
        "user_login": {
            "minWait": 600000,
            "maxWait": 604800000,
            "lifetime": 172800,
            "freeRetries": 4
        }
}
3

Thank you

Could you please tell me the meaning of “minWait”, “maxWait”, “Lifetime” and “freeRetries”?
And for testing, I want to set the expiration time to 1 minute.
Does this affect admin users?

4

Those config settings are for adjusting the brute-force protection, they won’t change session lifetimes.

Staff user session lifetimes are hardcoded and can’t be changed via config.

1 Like
5

Thank you for answer.
Dose it mean the session timeout period is 6 months?
(maxAge: constants.SIX_MONTH_MS)