Define active session timeout exception roles
Use a system property to exempt roles from active session timeout limits.
Use the glide.active.session.timeout.exception.roles system property to exempt roles from an active session timeout limit. The active session timeout feature helps ensure that a hijacked session cannot be used indefinitely without providing authentication information. It is best practice to only consider an active session timeout limit exception for internal integration account roles.
Configure the glide.active.session.timeout.exception.roles property to roles which must be exempt from active session timeouts. This property value is a comma separated list of roles. The default value is edge_encryption,mid_server,maint.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.active.session.timeout.exception.roles |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | string |
| Recommended value | edge\_encryption,mid\_server,maint |
| Default value | edge\_encryption,mid\_server,maint |
| Fallback value | edge\_encryption,mid\_server,maint |
| Category | Session management |
| Security risk | - Severity score: 6.4 - CVSS score: Medium - Consider an active session timeout limit exception only for internal integration account roles. If a user is a victim of a session hijacking attempt, and has a role with an exception, attackers using that session can continue to authenticate to that session indefinitely. This may increase the impact of a security incident by enabling an attacker more time to make use of a hijacked account. |
| Dependencies and prerequisites | None |
Parent Topic:Session management