site.ini [UserSessionSettings] #

The block [UserSessionSettings] of settings/site.ini, with 12 setting(s).

Never edit settings/site.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/site.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/site.ini.append.php for one siteaccess,
• extension/<extension>/settings/site.ini.append.php in an extension (read when the extension is active).

Tracking #

"Your devices": every sign-in is a row of the table expuser_session (when the table is there), with when it
started and was last used, the address, the browser and system, the sign-in method and Remember me. The user sees
them at user/sessions and signs out one session or all others; an administrator with the policy user/sessions does
the same for any user (user/sessions/<user id>). A session signed out there ends on its next request, on every
session handler. Guide: doc/eng-us/features/6.0/user-sessions.md
disabled: no rows are written and no session is checked (the pages say so).

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
Tracking=enabled
*/ ?>

TouchInterval #

The last use and address of a session are written at most this often (seconds), or when the address changes.

Default: 60.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
TouchInterval=60
*/ ?>

RecordIP #

How the addresses of sessions are kept: full, truncated (the network only: 203.0.113.x, 2001:db8:85a3::/48),
disabled (none), or audit: as audit.ini says for the audit ([UserAuditSettings] RecordIP=disabled: none,
[AuditPrivacySettings] Field[actor.ip]=off: none, truncate or hash: the network, full: the address).

Default: audit.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
RecordIP=audit
*/ ?>

GeoIPDatabase #

The approximate place of a sign-in, from a GeoIP database on this server in the MaxMind DB format (.mmdb, e.g.
GeoLite2-City.mmdb), relative to the installation or absolute; empty: no places. Needs the PHP extension maxminddb
or the Composer package maxmind-db/reader. Nothing is ever asked of another server. With it, a sign-in from a
country the account has not signed in from within RetentionDays is a "new location" (event and mail).

Default: empty.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
GeoIPDatabase=
*/ ?>

GeoIPLanguage #

The language of the place names the database holds (en when a name is not in it).

Default: en.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
GeoIPLanguage=en
*/ ?>

RetentionDays #

Ended sessions (signed out, revoked, expired) are kept this many days, for the list of recent sign-ins and to know
a device seen before; the cronjob usersessions.php removes them afterwards. Sessions not used for [Session]
SessionTimeout are ended by the same cronjob.

Default: 90.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
RetentionDays=90
*/ ?>

NewDeviceMail #

"New sign-in to your account" to the user, when a sign-in comes from a browser, system and device kind not seen
for the account within RetentionDays (category security). Each user can turn it off on the page.

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
NewDeviceMail=enabled
*/ ?>

NewDeviceAdminMail #

The same as a note to the administrators: AdminMailReceivers[], else [MailSettings] AdminEmail (category admin).

Default: disabled.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
NewDeviceAdminMail=disabled
*/ ?>

AdminMailReceivers #

Default: an empty list.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
# an empty "AdminMailReceivers[]" first replaces the shipped list; without it the items are added
AdminMailReceivers[]
*/ ?>

FirstSignInMail #

Whether the very first sign-in an account has here counts as a new device (there is nothing to compare it with).

Default: disabled.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
FirstSignInMail=disabled
*/ ?>

SecurityAlertMail #

"Security alert" to the owner of an account when two-step sign-in is turned on or off, a recovery code is used, sign-ins
fail FailedSignInAlertThreshold times in a row (0: never) or the account is locked (category security, design:user/
security_alert_mail.tpl, links to user/security). A user cannot turn these off; disabled turns them off for the site.
Sent from the user audit log (audit.ini [UserAuditSettings]): without it no alert is sent.

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
SecurityAlertMail=enabled
*/ ?>

FailedSignInAlertThreshold #

Default: 5.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[UserSessionSettings]
FailedSignInAlertThreshold=5
*/ ?>

Related #

• All blocks of site.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/site.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.