afs commented on issue #4033: URL: https://github.com/apache/jena/issues/4033#issuecomment-4858911678
> Is it correct that sessions are really immortal? If so, is that intentional? > Should this perhaps be configurable? The analysis looks plausible. The only time I can think of where sessions might be significant is for login to the server for admin operations. Fuseki operations themselves aren't making use of session state. We ought to set the admin UI to timeout, and set a safety default idle time regardless of configuration. My reading of the Shiro session documentation is that there is a default of 30 mins. That maybe too much for you and everyone else - we are talking machines contacting Fuseki, not people. Have you tried setting int shiro.ini? I'm not quite clear why each update causes a new session. Are the clients aren't sending the known auth information and doing a challenge/response on each operation because the effective user may have changed? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
