Issue
- Guest users should not be able to see the extend_session message in the browser once the session has expired.
Environment
- Liferay DXP [7.1-7.4, Quarterly Releases]
Resolution
- Post observing the time frequencies in the snapshot, it is seen that every request has around the interval of 4 minutes which is the current expected behavior and frequency.
- If the offset is reduced to 15 seconds, then this might help in reducing the volume of calls to the extend_session.
- A user always has a session, regardless of whether they are not yet logged in, actually logged in, or have logged out, etc. Usually, it is a different session when session.enable.phishing.protection=true i.e. user is switched to a new session after they log in (or after they are logged out), but they still have a session as long as they have the page open and the extend session requests are getting through to extend that session.
- Users can try overriding the \webapps\ROOT\html\common\themes\session_timeout.jspf to change the logic for setting the autoExtend value:
boolean autoExtend = !themeDisplay.isSignedIn() || PropsValues.SESSION_TIMEOUT_AUTO_EXTEND;.Might be the 'Custom JSP Bag' OSGi extension point is applicable for this type of override: JSP Overrides Using Custom JSP Bag - However, if this is done, kindly ensure to use the correct version as the 'source' and maintain and retest the custom version at the time of upgrading, etc.
Note: Liferay does not recommend to make this change. Users should make the changes at their discretion.