Rest API session expired

[minhhieu106]

Hi Mike,

I have a question about the session expire policy of Rest API. Please help to clarify.

I see on Rest API plugin System Settings. SessionExpiryInMinutes is "How many minutes of idle time before the users session expires".

So mean if after 5 minutes didn't have any call from application to server, the session will be expired? or after 5 minutes created, session will be expired?

Thanks,
Hieu

[SBarnes]

Hi Hieu

I believe it will expire 5 minutes or what ever the setting is set to after inactivity.

If you look in the actual web api plugin's code you will find the following code in the response filters region, which I believe advances the expiry time

Code: Select all

                     if (session != null)
                         req.SaveSession(session, TimeSpan.FromMinutes(sessionExpiryInMinutes));   

If you are concerned about a session expiring there is also the Keep Alive request that can be used to advance the session time.

[minhhieu106]

Hi Stuart,

Thanks for you answers.

How to use Keep Alive request?

I also have checked on the Rest API code. Seem this feature have not implemented yet?



Thanks,
Hieu

[SBarnes]

Hi Hieu

The code for Keep Alive doesn't need to do anything the simple fact that the request is made will cause the Response Filter to execute and adjust the session expiry.

If you want to test this in any plugin you can use the following code to launch visual studio, provided it is installed from any plugin, you could place this in the code of the response filter temporarily so that you can see it gets called when you make a call to keep alive.

Code: Select all

System.Diagnostics.Debugger.Launch();

[Mike.Sheen]

The code for Keep Alive doesn't need to do anything the simple fact that the request is made will cause the Response Filter to execute and adjust the session expiry.

Completely correct. We provided the KeepAlive route for web or mobile applications so they could have a client side timer asynchronously sending KeepAlive requests just to extend the session. We didn't want abandoned sessions maintained at the server end, as they would consume resources - so we figured if an application was running they could send a KeepAlive request in the background, and if the application was closed / disconnected then the session would not be extended.

We deliberately don't have any payload in the request or response of the KeepAlive request to minimise traffic.

[minhhieu106]

Hi Mike,

Thanks for your explanation in detail.

Hieu