Skip to content

Added details of security settings backported to 13 #7068

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 6, 2025
Merged

Added details of security settings backported to 13 #7068

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion 13/umbraco-cms/reference/configuration/securitysettings.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,9 @@ A full configuration with all default values can be seen here:
},
"UserDefaultLockoutTimeInMinutes": 43200,
"MemberDefaultLockoutTimeInMinutes": 43200,
"AllowConcurrentLogins": false
"AllowConcurrentLogins": false,
"UserDefaultFailedLoginDurationInMilliseconds": 1000,
"UserMinimumFailedLoginDurationInMilliseconds": 250
}
}
}
Expand Down Expand Up @@ -136,3 +138,9 @@ The default lockout time for users is 30 days (43200 minutes).
## Allow concurrent logins

When set to `false`, any user account is prevented from having multiple simultaneous sessions. In this mode, only one session per user can be active at any given time. This enhances security and prevents concurrent logins with the same user credentials.

### User login duration

Umbraco provides protection from user enumeration attacks looking to identify valid backoffice login accounts. It does this by attempting to equalize the time taken for successful and failed logins.

The `UserDefaultFailedLoginDurationInMilliseconds` can be used to provide a more realistic expected time for a successful login if the default isn't appropriate. This will be used before actual successful logins are detected. `UserMinimumFailedLoginDurationInMilliseconds` provides a minimum duration for a failed login.