Controlling session timeouts
Overview
To prevent cross-site request forgery (CSRF), the system uses time limits on sessions and protects them with secure tokens.
By default, a token remains valid for 2 hours. If you have been inactive for more than 2 hours, your next action in the web interface or Amplify will redirect you to the login page. Inactivity occurs when you are no longer interacting with a page, for example, closing your tab or browser.
By default, sessions are valid for 10 hours. After continuously using the web interface for 10 hours, the session expires, and you must log in again to renew the session.
This may be transparent to single sign-on (SSO) users if your SSO session is still valid because SSO sessions are configured directly in your Identity Provider.
Setting token validity periods and session timeouts
Contact Nexthink Support to configure token validity periods and the maximum duration of sessions.
Long intervals make your Nexthink tenant vulnerable to CSRF attacks.
Overriding session timeouts
You can grant users a special privilege that keeps them logged in indefinitely and bypasses the configured session timeout value.
For more information, refer to the Setting personal data and profile section in the Users documentation.
RELATED TASK
Last updated