influxd --session-length has no effect

[dnr]

I'm trying to configure influxd 2 on a local network to not require logging in (at least not very often). The --session-length flag seems the obvious one to change, and I changed it to one year (in minutes), but it seems to have no effect and I'm prompted to log in frequently.

I'm running it in docker.

Steps to reproduce:
List the minimal actions needed to reproduce the behavior.

1. Run influxd 2.0.0-beta with --session-length=525600
2. Log in to the web UI and view a dashboard
3. Wait 24 hours
4. Visit the same url again (in the same browser session)

Expected behavior:
I expect to see the dashboard and not be prompted to log in.

Actual behavior:
I get prompted to log in.

Environment info:

• System info: Run uname -srm and copy the output here
  Linux 5.3.0-24-generic x86_64
• InfluxDB version: Run influxd version and copy the output here
  InfluxDB 2.0.0-beta.5 (git: 2295247a5) build_date: 2020-03-09T01:32:06Z
• Other relevant environment details: Container runtime, disk info, etc
  docker top:

UID                 PID                 PPID                C                   STIME               TTY                 TIME                CMD
root                15978               15957               0                   Mar04               ?                   00:52:05            influxd --reporting-disabled --bolt-path=/influx/influxd.bolt --engine-path=/influx/engine --session-length=525600

Config:
Copy any non-default config values here or attach the full config as a gist or file.

From docker inspect:

...
        "Args": [
            "--reporting-disabled",
            "--bolt-path=/influx/influxd.bolt",
            "--engine-path=/influx/engine",
            "--session-length=525600"
        ],
...
        "Image": "sha256:cc6ce7f90cdd0a6f921ae6f127f09f110bdf250c3e1336bab0a363ed25977cfe",
...
        "Config": {
...
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "DEBIAN_FRONTEND=noninteractive"
            ],
...
            "Cmd": [
                "--reporting-disabled",
                "--bolt-path=/influx/influxd.bolt",
                "--engine-path=/influx/engine",
                "--session-length=525600"
            ],
...
            "Image": "quay.io/influxdb/influxdb:2.0.0-beta",
...
        },
...

Logs:
Include snippet of errors in log.

ts=2020-03-09T01:22:47.341672Z lvl=info msg=Unauthorized log_id=0LMFedNW000 error="session has expired"

[russorat]

@dnr thanks for opening this. We will take a look.

[andig]

Any progress on this? The current behaviour is really annoying.

[kristinarobinson]

@andig Sorry I closed this in error, because my team isn't directly involved in the fix. Here's an update. The session auto-logout has been increased from 4 hours to 8 hours, or at least it's the process of being increased on a region by region basis. The back end teams are working on coordinating a change to implement an active session timeout, that is, your session timeout limit will be reset every time you are active within the system. I don't have an ETA on that work, however, as I'm not on those teams, and I haven't checked in on that project recently. I hope that helps.

[asalem1]

Removing the UI team label since session management is handled by the compute & e-commerce team in unison

[nuwandavek]

Has there been any update on this? Either increasing session timeout or having a config to remove auth (for local networks) would be an awesome fix.
Thank you!

[ssuchter]

I also agree - it'd be nice to not have to log so frequently into the influxd instances where I don't need this level of security.

[samhld]

@dnr are you (still) experiencing this in OSS?

[divinitus]

@dnr are you (still) experiencing this in OSS?

I am. Logging into OSS instance that often is definitely annoying.

[dnr]

Yes, this is still annoying.

[lesam]

@dnr @divinitus @ssutcher I had a look at this.

InfluxDB OSS is storing session data in in-memory storage. I am able to see the session-length working if I set it to a shorter value. Will leave it running overnight and see if setting to a longer value reproduces the issue for me.

Which OSS version are you running currently?
Are you rebooting / restarting the InfluxDB process overnight? A process restart would invalidate all the sessions (since the session data for OSS is in memory).

[ssuchter]

I'm running:

InfluxDB 2.1.1
Server: 657e183
Frontend: cc65325

No, I'm not restarting the InfluxDB process overnight, or with any regularity. My instance tends to stay up for weeks to months.

[divinitus]

Mine is:
InfluxDB 2.1.1
Server: [657e183]
Frontend: [cc65325]

It's in a container under podman.

[ssuchter]

FWIW, I'm not running containerized; it's a direct RPM install on Centos Stream 8, running under systemd.

[lesam]

Aha! I think the issue is that the backend is tracking expiry correctly, but the browser (e.g. Chrome) is not being told about the expiry, and so expires the cookie automatically when the browser restarts. There is a PR above to fix that works for me locally - at least it fixes preserving the cookie across browser restarts.

[divinitus]

Aha! I think the issue is that the backend is tracking expiry correctly, but the browser (e.g. Chrome) is not being told about the expiry, and so expires the cookie automatically when the browser restarts. There is a PR above to fix that works for me locally - at least it fixes preserving the cookie across browser restarts.

The scenario for me is to have FF98 open all the time. I open a new tab, navigate to InfluxDB -> login -> watch the graphs -> close the tab.
When i try to access it again i open a tab -> navigate to influx -> bang, have to login again.

So at least in my dictionary this is not a browser restart. It's a new tab-close tab cycle.

[josevnz]

This is an annoying bug; I end using Grafana UI instead of Influxdb to run queries because of this bug, as the timeout is too short even for medium datasets.

[sstewart-hirez]

Yes I am actually using Grafana UI as well so I don't have to login all of the time

[logmod]

@lesam From what I can see, the way server-side session cookies are handled by InfluxDB is clearly understood so its just a matter of making this feature available/visible to users either by configuration or by a change to the login UI. I would even be fine with a decent default like 8h or 12h but the current setting is way too short. InfluxDB is not a banking app but a monitoring tool.

Practically all solutions with a web-interface nowadays have the option to set a userdefined "keep me logged in" flag. If the InfluxDB session timeout annoys so many people why can't this be changed?

[Klaital]

Has there been any progress on this? I'd like to set up an always-on dashboard for my home automation. I'm running the OSS version on-prem, so I do not need high security.

I appreciate the suggestion to just use Grafana as the UI instead. I know that will do the job.

[aerogus]

I also always be logged out after a couple of minutes.
I use v2.6.1, the last one at the date.
I'd wan't a feature to be always logged in for a entire day.
I don't understand why this issue has been closed.
Where is the session length configurable ?
thx

[update]
sorry finally it's working well.
I just changed in the configuration file the session-length value (default to 60) and restarted influxdb
https://docs.influxdata.com/influxdb/v2.6/reference/config-options/#session-length