Scheduled Tasks

Remove Expired Admin Login Sessions

When a user logs in to Sana Admin, a login session will be created for this user. In order to minimize the time period an attacker can launch attacks over the active sessions and hijack them, there is an expiration timeout for every session, establishing the amount of time a session remains active.

If the user does not perform any actions in Sana Admin for a while, the session will expire, redirecting the user to the login page.

• In Sana 9.3.0 - 9.3.3 Sana Admin login session expires in 20 minutes.
• Starting from Sana 9.3.4 Sana Admin login session expires in 360 minutes (6 hours).
  

The Remove expired admin login sessions task removes all expired Sana Admin login sessions from the database.

Set up the "Remove expired admin login sessions" task

To set up the Remove expired admin login sessions task, click Edit.

The table below provides the description of the Remove expired admin login sessions task settings:

 NOTE

Starting from Sana 9.3.4, when customers log in to the Sana web store, the login session will be created for them. If the customer does not perform any actions in the web store, the session will expire in 20 minutes, redirecting him or her to the login page.

Starting from Sana 9.3.4, a web store administrator can change login session expiration time for both, Sana Admin and web store, in the "Web.config" file of the Sana Commerce Frontend.