mORMot Open Source

anouri

Member

Registered: 2024-02-11

Posts: 154

Can't change SessionTimeOut

Hello,

I am having trouble with session timeouts in my REST server. I have set the SessionTimeout to 100, but the session still expires after 10 minutes.

Here is my OnAuthenticationUserRetrieve event handler:

fPassakServer.OnAuthenticationUserRetrieve := AuthenticationUserRetrieve;

function TfrmMain.AuthenticationUserRetrieve(Sender: TRestServerAuthentication; Ctxt: TRestServerUriContext; aUserID: TID;  const aUserName: RawUtf8): TAuthUser;
begin
  if ThreadSafeUsers.Exist(aUserName) then
  begin
    var User := ThreadSafeUsers.FindByLogonName(aUserName);
    Result := TAuthUser.Create;
    Result.LogonName := User.LogonName;
    Result.PasswordPlain := User.PasswordPlain;
    Result.IDValue := User.IDValue;
    Result.GroupRights := User.GroupRights; 
    Result.GroupRights.SessionTimeout := 100;
  end;

end;

create TUser objects and store them in a thread-safe array named ThreadSafeUsers.FUsers.

A separate issue I have is with initializing the TAuthGroup. When I try to create it with AuthGroup := TAuthGroup.Create, I get an Access Violation (AV) error. However, using AuthGroup := TAuthGroup.CreateWithID(1) works fine.

I am struggling to understand how to properly create users and groups dynamically in this framework.

My auth service:
https://gist.github.com/a-nouri/46f6b58 … 694b30616d

Last edited by anouri (Yesterday 14:16:13)

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 15,302

Website

Re: Can't change SessionTimeOut

Thanks for posting a gist with some code. It is easier to find out what you did and what you expect.

If you debug a little bit, you would probably find that SessionTimeout is used by ComputeProtectedValues(), from TAuthSession.Create.

Then, in TAuthSession.Create, the TAuthGroup instance is created and read from the ORM.
Filing aUser.GroupRights with your own instance does not make any sense. It just won't work.

This is as documented: TAuthUser.GroupRights is not a TAuthGroup instance here, it is a TAughGroup ID (see comments like retrieve pseudo TAuthGroup = ID)

So you need to create proper groups and store them in the ORM, not make your own fake in-memory pure TAuthGroup instances.