New Security Feature Request for Portal Logon Timeout
We have noticed that our current setup of the Customer Portal and Admin Portal does not include a logon timeout period. We would like to request a feature that allows us to set a logon timeout period for the customer portal, both for when there is no user activity and when the OAuth credentials expire.
Specifically, we would like this feature to be available for:
Customer logon on the website
Customer logon on the mobile apps
Admin portal logon
This feature would greatly enhance the security and user experience of our portal by ensuring that sessions are appropriately managed and automatically logged out after a period of inactivity or when credentials expire.
Thank you for considering our request. We look forward to your response and any guidance you can provide on this matter.
Log in to comment and vote
Comments2
bwm-dc
Jan 8, 2025
The Admin portal already does have a login timeout - you set it (on a per-Admin basis) under
<splynx_url>/admin/administration/administrators, and it is called “Timeout.”
However, an Admin is allowed to modify their own Timeout through their Profile, which I see as a major concern (I don’t want our sales or install teams being able to adjust their own timeout setting). It would be nice to be able to set a “default” timeout as well, and then override per-Admin as needed.
I agree that the ability to set a timeout for Customers would be helpful, and website should be separate from the mobile app if possible.
PeteB
Jan 8, 2025
Thank you for the feedback. I have set a timeout for the admin logon.
I would prefer to do the same for the customer logon (but non-configurable to set its timer or indefinite logon). The risk with the current setup for the customer logon is that if they login from an internet cafe, their credentials are still open for the next user who goes onto the same logon page.