Skip to main content

Change the App session timeout

An App keeps its own session, separate from the Informer login session. It controls how long a running App stays signed in, including one opened from a home screen tile or embedded in Informer GO. Configure it by editing config.json and setting appViewTokenTtl (in milliseconds):

{
  "appViewTokenTtl": 3600000
}

The example above sets the App session to one hour. The default is 48 hours.

You can also set it per deployment on the command line, for example --appViewTokenTtl=3600000. If you already scope options under the auth module, the nested form still works and takes precedence over the top-level key:

"plugins": {
  "./modules/auth": {
    "appViewTokenTtl": 3600000
  }
}

Accepted values​

The value must be a whole number of seconds (a multiple of 1000), at least 5 minutes, and at most 30 days. A value outside that range stops the server at startup with an error rather than starting on a setting that would not work. The server logs the value it resolved when it starts, so you can confirm your change took effect:

['auth','app-view-token-ttl'] 'app_view' session TTL: 3600000ms (1h, deployment-configured)

How the timeout is applied​

This depends on whether your deployment serves Apps from their own origins, which is the case when app.appsBaseUrl is set.

On App origins, the session slides. Once less than half the timeout remains, the next request from the App renews it for the full period. An App that is used at all within each window stays signed in indefinitely, and an idle App is signed out somewhere between half the timeout and the full timeout.

Otherwise, the timeout is a fixed window that starts when the App is opened. Activity inside the App does not extend it, but opening the App again starts a fresh window. At the default of 48 hours, someone who opens an App at least once every couple of days is not asked to sign in again.

One exception, on App origins​

A browser that refuses cookies for the App's own web address cannot hold a sliding session, so an external link opened in such a browser gets a session carried in the page itself. Two things differ for that session:

  • It does not slide. The window is fixed from the moment the link is opened, and opening the link again is what starts a fresh one.
  • It is capped at 48 hours even when appViewTokenTtl is set higher. Raising the setting past 48 hours therefore has no effect on these sessions, because the credential is reachable by the App's own code in a way a cookie is not.

Lowering appViewTokenTtl below 48 hours does apply to them, like any other App session.

This is not the login session timeout​

The two are independent and are set in different places. The login session timeout governs signing in to Informer itself. appViewTokenTtl governs only App sessions.

When an App session ends, the App tries to rebuild it from your Informer login session before asking you to sign in, so a short App timeout is not necessarily visible to users with a live Informer session.

note

An App session credential cannot be revoked before it expires. Shortening this value narrows the window in which a leaked credential would still work, which is worth weighing against the convenience of a longer session. Share links you create yourself are revocable at any time and are not affected by this setting.