Session expires while working in backend

[maettyhawk]

Affected version(s)
Contao 4.4.28
1&1 Internet SE - Business 5.0, PHP7.2

Description
While working on an article in the backend for 10-20 minutes I get logged out from time to time. After logging in again a dialog appears stating that the request token isn't valid anymore. All my work I did in the meantime is gone. In the settings the session expiration time is set to the default.

How to reproduce
It's hard to reproduce since it happens on a non-regular basis. Most of the time the error occured when I was doing this:

• add text element to an article
• copy and paste contents into the WYSIWYG area, modify contents
• press save
• login screen appears

[asaage]

Most likely related to contao/core-bundle#1428
Even in 4.6 i'am always kicked out of the BE before $GLOBALS['TL_CONFIG']['sessionTimeout'] expires.

[maettyhawk]

You probably mean contao/core-bundle#1428, right?

As suggested I set session.gc_maxlifetime to a higher value - hope it'll fix it.

Most likely related to https://github.com/contao/core-bundle/issues/14287
Even in 4.6 i'am always kicked out of the BE before $GLOBALS['TL_CONFIG']['sessionTimeout'] expires.

[maettyhawk]

Still not working properly 😢

[leofeyer]

@maettyhawk We are going to need more information here, ideally a reproducible scenario.

[biwerr]

I have a similar szenario with one of my customers. They had worked on an Newsarticle for about 2 hours, within these time the session expired. After they hit the save button they ended up with the login screen, after login the changes where gone.

Step to reproduce:

• Set in system/config/localconfig.php the Value for $GLOBALS['TL_CONFIG']['sessionTimeout'] to 30 Seconds (for test case only)
• Open an Artikel, an keep editing for 30 seconds, and save your Work
• Loginscreen will appear, which is quite ok, but the post data should be saved in the new Session
• Login with your Credentials
• You will end up on the Article (maybe with a referer warining)
• You will see that the changes are gone (changes should be applied)

Problem could be solved in differend Ways:

• Store the post data in the new Session and apply it after successfull login
• Sending a xhr heartbeat when you are in an editmode, for keep the session open.
• Show an Notification to the user (Modal, Popup or somesthing like that) when the session is about to expire.

[biwerr]

@leofeyer could you please reopen the issue, mabye with lable feature?

[leofeyer]

Your comment reads more like a feature request and does not seem to be related to the reported problem, therefore please open a new ticket.