Matomo login timeout

marcusquinn

Anyone else get a very short login timeout? (I guess maybe minutes, definitely not hours)

Could do with the login timeout being days or weeks really, get me a few seconds back in my days

d19dotca

I haven't noticed this myself, no. But I'm not really idle in that app either. How quickly is it for you if you were to time it? Is it consistent each time too or sporadic?

marcusquinn

@d19dotca Difficult to say - but certainly don't need to be auto-logged out from anything within 24h my computer login is enough security for my needs.

imc67

@marcusquinn I do experience the same, auto logout within minutes of inactivity. Really annoying.

nebulon

I can confirm that I see that as well, but since I don't actively use matomo all that much, I thought this was just "regular" relogin about every week. Anyways clearly this should not be as short.
I've created https://git.cloudron.io/cloudron/matomo-app/-/issues/29 to track this.

girish

For testing, I had left it logged in yesterday but it logged out today

marcusquinn

Matomo I think is brilliant and very happy with it compared to Google Analytics which is so CPU heavy in the browser and convoluted to add users and permissions etc.

A longer time out would be perfection - thank you kindly!

girish

As per https://github.com/matomo-org/matomo/issues/7316#issuecomment-76630391, if you check the remember me, you will be logged in forever. So, that's what I have done now. Not idea but this seems like an upstream bug.

marcusquinn

@girish That's the thing; I tick "Remember me" but it has the memory of that person that says I'll get the next round then disappears

marcusquinn

This still bugs me - and when it does timeout it shows the login form in duplicate and doesn't work, so you then need to revisit the root URL to login again.

Hacky workaround for now using browser refresh extensions:

https://chrome.google.com/webstore/detail/tab-reloader-page-auto-re/dejobinhdiimklegodgbmbifijpppopn

https://addons.mozilla.org/en-US/firefox/addon/tab-reloader/?src=search

https://addons.opera.com/en/extensions/details/tab-reloader/

marcusquinn

Still annoying, maybe a fix here?...

Something to do with the Cookie and Remember Me not working. Maybe LDAP related? Who knows?

nebulon

This may actually be fixed now with the release I've just made for the new upstream version.
Would be good to get some feedback

marcusquinn

@nebulon Cool - just updating now to test - will check and post observations here. Thanks!

marcusquinn

@nebulon Updated but still the same. It's odd, and I can't see any setting I might be missing. Experience of others to compare may help?

imc67

@marcusquinn same here, both Matomo apps have the same issue: auto log out quite fast.

marcusquinn

Not sure if I've solved the timeout but I have learned something else:

To install plugins, you need to Activate the "Login (Core)" plugin.

This then makes two login forms appear at the same time.

It might also have a shorter login timeout effect (to be confirmed).

The duplicate login form solution is to then Deactivate the "Login (Core)" plugin once whatever other plugins are installed and activated.

Solves one thing, might help others if it is related and anyone else hadn't figured that bit out yet.

cbeams

I'm still seeing this behavior (remember me not working) on the latest Matomo Package v1.23.1 / App v4.1.1. I see the fix for it happened quite a while ago at https://github.com/matomo-org/matomo/issues/15625#issuecomment-592580628, so I don't understand why it's still happening. See my comment about it at https://github.com/matomo-org/matomo/issues/15625#issuecomment-770823919.

nebulon

@cbeams actually I can see this also happening here. A quick look at the session store reveals, that no sessions are saved to /run/matomo/session this is odd, but maybe matomo is actually using some other storage somewhere else...have to investigate.

cbeams

@nebulon Thanks. As I mentioned in a follow-up to my comment above, I've actually now gotten everything working as expected, or at least it seems that way. I think it had something to do with one of or a combination of:

clearing my cookies for the site
logging out of matomo
quitting my browser process
restarting matomo itself

At some point in the process of doing all these things, I started getting the expected remember me' / persistent login behavior.

cbeams

@nebulon sigh... I take it back. I thought I had this sorted, but I've been getting logged out again as I was before.

A quick look at the session store reveals, that no sessions are saved to /run/matomo/session this is odd, but maybe matomo is actually using some other storage somewhere else...have to investigate

Indeed my /run/matomo/session dir is empty as well, but I do notice that /run/matomo/tmp/sessions is not:

root@dc23980a-557c-4199-ad52-8d1139a19467:/app/code# ls -l /run/matomo/tmp/sessions/
total 16
-rw-r--r-- 1 www-data www-data  20 Feb  1 15:42 index.htm
-rw-r--r-- 1 www-data www-data  20 Feb  1 15:42 index.php
-rw------- 1 www-data www-data 278 Jan 16 16:58 sess_58ac4nlca9d8na9tb4selvf1mu
-rw------- 1 www-data www-data 278 Jan 16 16:58 sess_b6ah1mt6739rjka699reutrf54

Both of the session files there are rather old, though, and neither match the active session ID I see in my browser's dev tools:

Perhaps this provides a clue.

P.S.: If you notice the longer-than-usual expiry period for my cookie, it's because I set login_cookie_expire = 315360000 in config.ini per the instructions here as part of my previous attempts to solve this problem. The config parameter does in fact extend the expiry beyond the default, but does not have any effect on getting remember me functionality to actually work.

marcusquinn

@cbeams Nice, just tried the clearing cookies & resrarting the browser, and that seeeeems to be solving for me now - but I've been tricked to thinking this before so will check back and confirm either way after a reboot or two.

nebulon

I investigated a bit further and found that matomo actually stores sessions in the database in the session table.

Unfortunately looking at that table does not yet reveal why the sessions time out so frequently.

cbeams

@nebulon Thanks for looking into it further. It certainly is an annoying problem!

That's interesting regarding the session table, especially in light of this comment from https://github.com/matomo-org/matomo/issues/15625#issuecomment-770846839

Maybe session file on your server gets removed for some reason. Don't know what could be the problem.

Perhaps he is confused about this too, but I assumed he was someone knowledgeable about Matomo.

marcusquinn

@cbeams OK, turns out it wasn't fixed - back to short logout times. Very strange, some software designers really don't seem to think this sort of thing is an issue, clearly over absorbed in their own ideas and under appreciative of users.

Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.

Matomo login timeout