Timeout and Re-authentication
Protect working sessions with screen lock or logout based on time and activity
The auth_timeout module requires users to re-authenticate after inactivity or after a fixed amount of time since the last login.
This is especially useful for finance, HR, or any environment that wants to reduce the risk of unattended sessions.
Two timeout types
Session Timeout vs Inactivity Timeout
| Type | How it is measured | Example |
|---|---|---|
| Session Timeout | Measured from the last login, even if the user is still active | A 1-day timeout means re-authentication is required after 24 hours. |
| Inactivity Timeout | Measured by the amount of time with no activity | A 15-minute timeout means the session locks after 15 minutes without interaction. |
Configure timeout by user group
Steps
1. Go to Settings → Users & Companies → Groups.
2. Open the group to configure, such as Sales / Manager.
3. In the Security tab, enable Session timeout and choose the time and action to apply.
4. Enable Inactivity timeout as well if the screen should lock when the user is idle.
5. Choose whether two-factor authentication is required on re-entry.
6. Save the configuration and test it with an account in that group.
What happens when a timeout occurs
Key points
• Depending on configuration, the system may fully log the user out or just lock the screen.
• When timeout is triggered, the user sees a re-authentication prompt such as “Please confirm your identity”.
• If the policy requires it, the second factor may also be requested again.
Re-authentication methods
| Fields | Trường dữ liệu | Description |
|---|---|---|
| Password | Mật khẩu | Use the current account password to unlock the session. |
| Passkey | Passkey | Use Face ID, Touch ID, Windows Hello, or a hardware security key. |
| TOTP | TOTP | Enter the verification code from an authenticator app. |
| TOTP Mail | Mã qua email | Enter the verification code sent by email if supported. |
Configuration examples
Security levels by group
| Group | Session timeout | Inactivity timeout | Meaning |
|---|---|---|---|
| Senior management | 12 hours with 2FA | 15 minutes with 2FA | Frequent re-authentication for sensitive accounts. |
| Office employees | 1 day without 2FA | 30 minutes without 2FA | Balance convenience with protection. |
| Sales staff | Not enabled | 1 hour without 2FA | Prioritizes speed while keeping a basic safeguard. |
Important notes
Key points
• Timeout is applied by user group, and when a user belongs to multiple groups the shortest effective timeout may win.
• Passkey and TOTP are already strong methods and can satisfy re-authentication more securely than password-only flows.
• Inactivity is often tracked through WebSocket or browser activity signals.
• Closing the browser or losing connectivity may cause the session to be treated as inactive.
Troubleshooting
Common issues
| Issue | Cause | Solution |
|---|---|---|
| Timeout happens too often | The configured timeout is too short | Adjust the policy to match the needs of that user group. |
| Cannot re-authenticate | Password forgotten or 2FA device lost | Use another available method or ask an admin for a reset. |
| Timeout occurs even while working | WebSocket or internet connection is unstable | Check connectivity, refresh the page, and try again. |