It is essential to address the issue of session management when using any application to enhance security and effectiveness. As for Odoo 19, it is necessary to mention that the problem of session management is very important because it allows to control the period of a user staying in the system.
What is Session Expiration?
A Timeout Session can be defined as the period of time that elapses between the period of idleness of the user’s account and the automatic logging out of that account due to the period of time elapsed. Upon expiration of this period of time, the user has to securely log in again to conduct any business.
Odoo uses sessions through cookies, which are always stored on the server. Sessions last for certain periods of time, and become invalidated upon inactivity by the user in terms of entering data, clicks, refreshes, etc.
Why Session Expiration Matters
Without session management in the systems, the following challenges arise:
- Access by the Unauthorized User: The user leaves the common work area without controlling the computer, and the session is still active, hence giving the unauthorized user access to the system.
- Sessions Hijacking: The longer the sessions remain active, the higher the possibility that the session token will be hijacked.
- Resource Overloading: There is no limitless capacity of server resources. Thousands of active sessions will occupy server resources.
By adopting a session timeout policy, there will be:
- Enhanced Security: Shortened exposure period.
- Effective Resource Management: Release of server memory by terminating idle sessions.
- Efficient User Management: Effective user management activities in the ERP system.
How to Enforce Session Limits in Odoo
However, it depends a lot on the framework (werkzeug) itself in order to manage everything that needs to be managed regarding the state of the application. Even though it will be easier for the developers to keep the connection open for a very long time, it becomes necessary to do something else in the business environment.
In order to be able to control everything related to the timeout of the connection, it becomes very necessary for the managers to make changes in the server settings or to use community extensions such as the popular one called web_session_timeout. It allows the system to do the following things:
- Minutes Idle Setting: The number of minutes after which the user will become idle enough to start the log-out process.
- Warnings: Use warnings to inform users about the remaining time before their session expires.
Best Practices for Finding the Right Balance Between Security and Usability
It is hard to provide such a balance between security and efficiency. Too strict timeouts configuration would make employees unhappy and create a favorable situation for information leakages.
Here you can find some best practices to consider during the creation of your system:
- Custom timeouts based on the user role: All users don’t have the same level of access to sensitive information. The one who manages the company’s finances should have 15 minutes of inactivity timeout, but the one who is looking through the knowledge base will stay logged in for two hours.
- Inform users about inactivity timeout: In case of an unexpected logout, the user will lose information and be dissatisfied. Implementation of the feature, which will show the user that he has 60 seconds before timeout, will definitely improve his experience.
- Cookie protection: All session parameters have to be securely stored. Using HttpOnly and Secure flags guarantees that no external script will be able to get session token information.
- Monitoring of session logs: Analysis of logs periodically is very helpful for the detection of possible problems and adjustment of timeout parameters based on real-life situations.
The implementation of the proactive approach to managing session timeouts is no longer an option but a must. With proper settings for session handling in your Odoo environment, you will reduce the likelihood of letting in hackers without affecting the performance of your server. It means that it has become clear once again that security and usability do not necessarily contradict each other.
To read more about How User Session Creation Works In Odoo: Everything You Need to Know, refer to our blog How User Session Creation Works In Odoo: Everything You Need to Know.