From 90054e0e7c2703d98d182ad169a6c1c8af8f6276 Mon Sep 17 00:00:00 2001
From: pieterlukasse <pieterlukasse@gmail.com>
Date: Fri, 5 Jul 2024 20:31:11 +0200
Subject: [PATCH] feat: set default session timeout to 20 min

---
 pom.xml                                                | 1 +
 src/main/java/org/ohdsi/webapi/ShiroConfiguration.java | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 954366c26..69dd489c0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -158,6 +158,7 @@
     <security.maxLoginAttempts>3</security.maxLoginAttempts>
     <security.duration.initial>10</security.duration.initial>
     <security.duration.increment>10</security.duration.increment>
+    <security.session.timeout>1200000</security.session.timeout>
 
     <security.saml.enabled>false</security.saml.enabled>
     <security.saml.entityId></security.saml.entityId>
diff --git a/src/main/java/org/ohdsi/webapi/ShiroConfiguration.java b/src/main/java/org/ohdsi/webapi/ShiroConfiguration.java
index 4831d0a9b..eb991a62b 100644
--- a/src/main/java/org/ohdsi/webapi/ShiroConfiguration.java
+++ b/src/main/java/org/ohdsi/webapi/ShiroConfiguration.java
@@ -42,6 +42,8 @@ public class ShiroConfiguration {
     private long initialDuration;
     @Value("${security.duration.increment}")
     private long increment;
+    @Value("${security.session.timeout}")
+    private long globalSessionTimeout;
     @Value("${spring.aop.proxy-target-class:false}")
     private Boolean proxyTargetClass;
     @Autowired
@@ -78,8 +80,7 @@ public DefaultWebSecurityManager securityManager(Security security, LockoutPolic
         );
 
         // Configure session manager to set the session timeout
-        long globalSessionTimeout = 30000; // TODO - read from config
-        logger.info(">>>> Setting GlobalSessionTimeout to {}s...", globalSessionTimeout/1000);
+        logger.info("Setting GlobalSessionTimeout to {}s...", globalSessionTimeout/1000);
         DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
         sessionManager.setGlobalSessionTimeout(globalSessionTimeout);
         securityManager.setSessionManager(sessionManager);