You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@ranger.apache.org by "kirby zhou (Jira)" <ji...@apache.org> on 2022/09/20 07:24:00 UTC

[jira] [Commented] (RANGER-3919) Adding automatically terminate a session after a predefined timeout period (60 minutes) of inactivity.

    [ https://issues.apache.org/jira/browse/RANGER-3919?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17606956#comment-17606956 ] 

kirby zhou commented on RANGER-3919:
------------------------------------

Session timeout (default 60m)is controlled by web.xml which is not in conf directory. So our default conf  ranger.admin.kerberos.token.valid.seconds = 30s (second) is meaningless.

 

Mentioned in  https://issues.apache.org/jira/browse/RANGER-3635

 

And there is a mechanism to keep the session renewed, even if kerberos ticket has expired.

 

 

> Adding automatically terminate a session  after a predefined timeout period (60 minutes) of inactivity. 
> --------------------------------------------------------------------------------------------------------
>
>                 Key: RANGER-3919
>                 URL: https://issues.apache.org/jira/browse/RANGER-3919
>             Project: Ranger
>          Issue Type: Bug
>          Components: Ranger
>    Affects Versions: 2.3.0
>            Reporter: Sanjay Kumar Sahu
>            Priority: Major
>
> Web applications do not automatically terminate a session 
> after a predefined timeout period (60 minutes) of inactivity. 
> Adding automatically terminate a session 
> after a predefined timeout period (60 minutes) of inactivity. 
> This issue increases the window of opportunity for an attacker to gain unauthorized access to a user’s session. However, in order to exploit this issue, an attacker still needs to obtain a 
> valid session ID tokens.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)