Change the login session timeout

Configure the session timeout by editing config.json and setting the ttl (in milliseconds) for the session auth strategy:

"plugins": {
  "./modules/auth": {
    "strategies": {
      "session": {
        "ttl": 1800000
      }
    }
  }
}

The example above sets the timeout to 30 minutes. If a user closes the browser without logging out and returns before the timeout elapses, they are not asked to log in, and the session is renewed: resuming a session resets the timeout.

note

Earlier versions documented a top-level ttl directly under ./modules/auth. That location is deprecated; use strategies.session.ttl as shown above.