Disconnection every 30min

[ap0int3d]

Hi,

I seem to get disconnected from WebSSH every 30 min or so even when I am working in an SSH session. Is there anything I can do to avoid this ?

Here is what I get when it is happening:

Here are the truncated container logs:

webssh  | {"timestamp": "2026-09-06T11:26:37.678169Z", "level": "INFO", "logger": "webssh", "message": "Client connected: user1", "user": "user1", "sid": "Y1N-1WGe6d5bHT4mAAAD"}
...
webssh  | {"timestamp": "2026-09-06T11:56:38.689786Z", "level": "WARNING", "logger": "webssh", "message": "Socket authentication assurance rejected", "event": "handle_keep_alive", "user_id": 2, "sid": "Y1N-1WGe6d5bHT4mAAAD"}
webssh  | {"timestamp": "2026-09-06T11:56:38.692058Z", "level": "INFO", "logger": "webssh", "message": "Client disconnected: user1", "user": "user1", "user_id": 2, "sid": "Y1N-1WGe6d5bHT4mAAAD"}

If that helps, I logged in using a passkey configured on an LDAP directory account.

[bifrost0x]

Thanks for the detailed report and logs — they pinpoint the cause.

This is not specific to LDAP or passkey authentication. It is a consequence of earlier authentication hardening: WebSSH now tracks browser authentication sessions server-side with an absolute expiry and revalidates every authenticated Socket.IO action. A normal sign-in received a secure 30-minute default. Once that record expired, the next keep-alive event was correctly rejected, so the browser disconnected even though the underlying SSH session was still active.

The fail-closed enforcement is intentional, but a fixed default without a visible explanation or user-level control was not good behavior. PR #203 addresses that:

• each user can choose 30 minutes, 1 hour, 2 hours, 4 hours, or 8 hours under Settings → Preferences → Sign-in session;
• 30 minutes remains the default;
• the UI explicitly explains that browser sign-in expiry is separate from the SSH idle timeout, can occur while SSH is active, and applies from the next sign-in;
• the separate Remember me option remains unchanged at seven days.

The security boundary is not being removed. There is no unlimited or sliding-expiration option, the normal-session maximum is eight hours, and server-side authentication records, account-generation checks, ownership checks, and immediate revocation on logout, account lock, or account deletion remain enforced. This keeps the tightened authentication model while making the duration explicit and user-controlled.

Hope that behaviour meets a good mix between security and usability :)

[ap0int3d]

Hi,
thank you for the clear explanation.

Would it be possible to offer the ability to the user to extend their session by inputting their credentials/passkey in a popup window for example 10 to 15 minutes before expiry ?

I think it could also be interesting to add a variable in the compose file or in the admin panel to allow the admin to set the default timeout for the entire WebSSH deployment

[ap0int3d]

Maybe adding an idle timeout (if that is doable) could also counter balance the longer session timeouts. For example with 2, 4 and 8 hours WebSSH session timeout, there could be a 30 minutes idle timeout. When the 30 minutes timeout is getting close (say 1 ou 2 minutes before it expires) WebSSH could show a popup stating that the session will soon be closed with an extend button and a close button.

[bifrost0x]

Good Suggestions!
I will See what i can so. ;-)