Matomo login timeout

[girish]

For testing, I had left it logged in yesterday but it logged out today

[marcusquinn]

Matomo I think is brilliant and very happy with it compared to Google Analytics which is so CPU heavy in the browser and convoluted to add users and permissions etc.

A longer time out would be perfection - thank you kindly!

[girish]

As per https://github.com/matomo-org/matomo/issues/7316#issuecomment-76630391, if you check the remember me, you will be logged in forever. So, that's what I have done now. Not idea but this seems like an upstream bug.

[marcusquinn]

@girish That's the thing; I tick "Remember me" but it has the memory of that person that says I'll get the next round then disappears

[marcusquinn]

This still bugs me - and when it does timeout it shows the login form in duplicate and doesn't work, so you then need to revisit the root URL to login again.

Hacky workaround for now using browser refresh extensions:

https://chrome.google.com/webstore/detail/tab-reloader-page-auto-re/dejobinhdiimklegodgbmbifijpppopn

https://addons.mozilla.org/en-US/firefox/addon/tab-reloader/?src=search

https://addons.opera.com/en/extensions/details/tab-reloader/

[marcusquinn]

Still annoying, maybe a fix here?...

• https://forum.matomo.org/t/session-inactivity-timeout/36355/5
• https://github.com/matomo-org/matomo/issues/15625
• https://forum.matomo.org/t/remember-me-not-working-since-update/36233

Something to do with the Cookie and Remember Me not working. Maybe LDAP related? Who knows?

[nebulon]

This may actually be fixed now with the release I've just made for the new upstream version.
Would be good to get some feedback

[marcusquinn]

@nebulon Cool - just updating now to test - will check and post observations here. Thanks!

[marcusquinn]

@nebulon Updated but still the same. It's odd, and I can't see any setting I might be missing. Experience of others to compare may help?

[imc67]

@marcusquinn same here, both Matomo apps have the same issue: auto log out quite fast.

[marcusquinn]

Not sure if I've solved the timeout but I have learned something else:

To install plugins, you need to Activate the "Login (Core)" plugin.

This then makes two login forms appear at the same time.

It might also have a shorter login timeout effect (to be confirmed).

The duplicate login form solution is to then Deactivate the "Login (Core)" plugin once whatever other plugins are installed and activated.

Solves one thing, might help others if it is related and anyone else hadn't figured that bit out yet.

[cbeams]

I'm still seeing this behavior (remember me not working) on the latest Matomo Package v1.23.1 / App v4.1.1. I see the fix for it happened quite a while ago at https://github.com/matomo-org/matomo/issues/15625#issuecomment-592580628, so I don't understand why it's still happening. See my comment about it at https://github.com/matomo-org/matomo/issues/15625#issuecomment-770823919.

[nebulon]

@cbeams actually I can see this also happening here. A quick look at the session store reveals, that no sessions are saved to /run/matomo/session this is odd, but maybe matomo is actually using some other storage somewhere else...have to investigate.

[cbeams]

@nebulon Thanks. As I mentioned in a follow-up to my comment above, I've actually now gotten everything working as expected, or at least it seems that way. I think it had something to do with one of or a combination of:

• clearing my cookies for the site
• logging out of matomo
• quitting my browser process
• restarting matomo itself

At some point in the process of doing all these things, I started getting the expected remember me' / persistent login behavior.

[cbeams]

@nebulon sigh... I take it back. I thought I had this sorted, but I've been getting logged out again as I was before.

A quick look at the session store reveals, that no sessions are saved to /run/matomo/session this is odd, but maybe matomo is actually using some other storage somewhere else...have to investigate

Indeed my /run/matomo/session dir is empty as well, but I do notice that /run/matomo/tmp/sessions is not:

root@dc23980a-557c-4199-ad52-8d1139a19467:/app/code# ls -l /run/matomo/tmp/sessions/
total 16
-rw-r--r-- 1 www-data www-data  20 Feb  1 15:42 index.htm
-rw-r--r-- 1 www-data www-data  20 Feb  1 15:42 index.php
-rw------- 1 www-data www-data 278 Jan 16 16:58 sess_58ac4nlca9d8na9tb4selvf1mu
-rw------- 1 www-data www-data 278 Jan 16 16:58 sess_b6ah1mt6739rjka699reutrf54

Both of the session files there are rather old, though, and neither match the active session ID I see in my browser's dev tools:

Perhaps this provides a clue.

P.S.: If you notice the longer-than-usual expiry period for my cookie, it's because I set login_cookie_expire = 315360000 in config.ini per the instructions here as part of my previous attempts to solve this problem. The config parameter does in fact extend the expiry beyond the default, but does not have any effect on getting remember me functionality to actually work.

[marcusquinn]

@cbeams Nice, just tried the clearing cookies & resrarting the browser, and that seeeeems to be solving for me now - but I've been tricked to thinking this before so will check back and confirm either way after a reboot or two.

[nebulon]

I investigated a bit further and found that matomo actually stores sessions in the database in the session table.

Unfortunately looking at that table does not yet reveal why the sessions time out so frequently.

[cbeams]

@nebulon Thanks for looking into it further. It certainly is an annoying problem!

That's interesting regarding the session table, especially in light of this comment from https://github.com/matomo-org/matomo/issues/15625#issuecomment-770846839

Maybe session file on your server gets removed for some reason. Don't know what could be the problem.

Perhaps he is confused about this too, but I assumed he was someone knowledgeable about Matomo.

[marcusquinn]

@cbeams OK, turns out it wasn't fixed - back to short logout times. Very strange, some software designers really don't seem to think this sort of thing is an issue, clearly over absorbed in their own ideas and under appreciative of users.