[UserSessionSettings]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
The group [UserSessionSettings] of settings/site.ini.
File
settings/site.ini; override it in settings/override/site.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| Tracking | enabled | "Your devices": every sign-in is a row of the table expuser_session (when the table is there), with when it started and was last used, the address, the browser and system, the sign-in method and Remember me. The user sees them at user/sessions and signs out one session or all others; an administrator with the policy user/sessions does the same for any user (user/sessions/<user id>). A session signed out there ends on its next request, on every session handler. Guide: doc/eng-us/features/6.0/user-sessions.md disabled: no rows are written and no session is checked (the pages say so). |
| TouchInterval | 60 | The last use and address of a session are written at most this often (seconds), or when the address changes. |
| RecordIP | audit | How the addresses of sessions are kept: full, truncated (the network only: 203.0.113.x, 2001:db8:85a3::/48), disabled (none), or audit: as audit.ini says for the audit ([UserAuditSettings] RecordIP=disabled: none, [AuditPrivacySettings] Field[actor.ip]=off: none, truncate or hash: the network, full: the address). |
| GeoIPDatabase | (empty) | The approximate place of a sign-in, from a GeoIP database on this server in the MaxMind DB format (.mmdb, e.g. GeoLite2-City.mmdb), relative to the installation or absolute; empty: no places. Needs the PHP extension maxminddb or the Composer package maxmind-db/reader. Nothing is ever asked of another server. With it, a sign-in from a country the account has not signed in from within RetentionDays is a "new location" (event and mail). |
| GeoIPLanguage | en | The language of the place names the database holds (en when a name is not in it). |
| RetentionDays | 90 | Ended sessions (signed out, revoked, expired) are kept this many days, for the list of recent sign-ins and to know a device seen before; the cronjob usersessions.php removes them afterwards. Sessions not used for [Session] SessionTimeout are ended by the same cronjob. |
| NewDeviceMail | enabled | "New sign-in to your account" to the user, when a sign-in comes from a browser, system and device kind not seen for the account within RetentionDays (category security). Each user can turn it off on the page. |
| NewDeviceAdminMail | disabled | The same as a note to the administrators: AdminMailReceivers[], else [MailSettings] AdminEmail (category admin). |
| AdminMailReceivers[] | (empty array) | |
| FirstSignInMail | disabled | Whether the very first sign-in an account has here counts as a new device (there is nothing to compare it with). |
| SecurityAlertMail | enabled | "Security alert" to the owner of an account when two-step sign-in is turned on or off, a recovery code is used, sign-ins fail FailedSignInAlertThreshold times in a row (0: never) or the account is locked (category security, design:user/ security_alert_mail.tpl, links to user/security). A user cannot turn these off; disabled turns them off for the site. Sent from the user audit log (audit.ini [UserAuditSettings]): without it no alert is sent. |
| FailedSignInAlertThreshold | 5 |
See also
Generated example: site.ini [UserSessionSettings]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/site.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment