WebUI Session Timeout Setting

Questions
1

Your question

When I started with v0.16.8 the WebUI didn’t seem to ever time out. Now in later versions it seems like every time I step away from the UI for a little bit it boots me, even if I have an auto refresh extension enabled.

Did something change in a recent build to enforce a timeout, and is it adjustable?

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

This is likely the setting. WebUI login sessions use OAuth access tokens under the hood; the access token has a default lifetime of 1 hour (accessTokenExpiry), after which the browser session ends unless a refresh token silently renews it. This is configurable on the OidcProvider object.

WebUI sessions expire based on the OAuth access token lifetime, controlled by the accessTokenExpiry field on the OidcProvider singleton (Settings › Authentication › OIDC Provider). The default is 1h. If you’re being logged out more aggressively than that, it’s worth checking whether this value (or refreshTokenExpiry, default 30d) has been changed in your configuration, since a shortened accessTokenExpiry combined with something interrupting silent refresh (e.g. an auto-refresh extension reloading the page and losing in-memory refresh state) would produce exactly this symptom.

To adjust it, edit the OidcProvider object, for example:

{
  "accessTokenExpiry": "8h"
}

Reference: Tokens | Stalwart

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

I set it to 8 hours, restarted the server .. just now while working in the server settings, it kicked me out mid click. So the token is not renewing. It’s quite likely I just have a browser issue, but some confirmation would be nice.

4

Nothing new was introduced, and yes it is adjustable: accessTokenExpiry (default 1h), refreshTokenExpiry (default 30d) and refreshTokenRenewal (default 4d) on the OAuth settings, at Tokens | Stalwart.

But I don’t think expiry is your problem. The webui refreshes the access token by itself 60 seconds before it expires, and retries once on a 401 before giving up, so sitting idle should not log you out. Being logged out means the refresh itself failed, and raising the lifetime will not help with that. The usual cause of getting kicked mid-click while editing server settings is that tokens are revoked server-side when the account’s credential version changes, so saving a change that touches your own account’s credentials, roles or permissions invalidates your refresh token there and then.

To pin it down: which of the two settings did you raise to 8 hours, and does the logout correlate with saving a change to your own account, or does it happen while only viewing pages? If you can catch it in the browser devtools Network tab, what matters is whether the token endpoint call returns an error and which one. Server-side, auth.token-expired at that timestamp distinguishes revocation from plain expiry in its details field. One aside that is not your mid-click case but is worth knowing: the webui keeps tokens in sessionStorage, so a new tab or a restored browser session always starts logged out.

5

Thanks for the detailed information!

I was working offsite today, came back and and was all ready to troubleshoot. Got the console up, went into the tab… and it was logged in and stayed logged in.

I’ll keep this bookmarked and come back if it decides to start acting up again. I’m sure it was the browser being silly.