Remember me for admin

[shoulders]

Hi

Is there now a `Remember Me` option for the Joomla 4 admin area?

I know of the work around to used shared session and log on the frontend, which sounds stupid to be able to use the feature on the admin area, especially when i dont wont to be logged in on the frontend.

https://joomla.org.au/forum/q-a-tips-tr ... or-session

If ther isnt one, should i add a feature request to the Joomal Github?

shoulders

[Webdongle]

There is a security issue with having rember me for admin

[shoulders]

not sure about that, especially if I have to turn shared sessions on which I do not want to do and then I have remember me for admin but I have to stay logged in for the front end which is awkward when developing and messing.

I will see if there is a plugin for joomla or write one myself.

thanks

[Per Yngve Berg]

I use "Session Keeper". Hopefully it will get ported to J4.

[shoulders]

@ Per Yngve Berg - I appreciate the info and I will look into that.

It should be very easy for me to create a plugin that adds a remember me box to the admin only, that works with no core hacks. I am not able to do it just yet because I am in the middle of making another component.

If I get it working with J3 it will be just as easy to make it work for J4 but I need to get my head around the new extension format first.

[sozzled]

Is there now a `Remember Me` option for the Joomla 4 admin area ... [and if there isn't, should] I add a feature request to the Joomal Github?

Let's just stop there for a moment.

As @Webdongle observed in a slightly different way, the checkbox feature, used by the System - Remember Me plugin as a frontend-only feature, was designed that way since around the time of J! 1.5, I think. Unless you enable the Shared Sessions setting in the Global Configuration, backend sessions are designed to expire after a set amount of time (15 minutes) of "inactivity". Well, that's only half-true because sessions expire whenever they expire but, if you're using shared sessions, you're not logged-out when the backend session expires as long as you're still logged into the front end. Confused? Don't worry about it.

Leaving aside the technicalities, I'd give you a snowflake's chance in Hades that this idea will find its way onto the "to do" list for J! 4.

Here is my take on this problem: a lot of people complain that they login to the backend, fiddle around for a few minutes (or do something else) and when they're ready to resume their work they discover they've been logged-out and they have to login again. That's a common complaint and I get it. A few people work up sufficient energy to write into this forum.

If the level of noise (about something that's we've been living with for many years) was sufficiently loud enough to generate some kind of technological intervention, it begs the questions, "Why has this been a problem for the past dozen years?" and "Will there now be an option [in the next version of J! that is yet to materialise] to solve this problem?"

This is what I do about the problem:

(a) I never use shared sessions;
(b) I could not tell you if I have System - Remember Me plugin enabled or not; I never use the checkbox when I login (at the frontend and the checkbox feature doesn't exist on the backend login screen);
(c) I always have two user accounts: one for the frontend and one for the backend; I never use the backend account on the frontend;
(d) I never use template overrides;
(e) I never use third-party "session keeper" plugins;
(f) I don't have the "timeout" issue when I'm working on the backend—either I finish what I'm doing within the 15 minutes (or whatever it is) or login again to continue or go have a cup of coffee or do something else and then login again to resume OR I open a menu item in the backend (e.g. edit an article or some other item) and, if I don't close the browser window, I'm never logged-out.
(g) I've never lost any important changes that I've been working on.

It's actually quite simple. Would you believe that little-known keepalive feature still works all this time since J! 1.0?

A lot of people hope that the problems they've been living with for the past however long will somehow—"hopefully"—evaporate when (or whenever) the "next version" appears.

[shoulders]

@sozzled I welcome your feedback,

I have this issue all of the time. I currently have set my session to be 360mins (database) to avoid the logout issue but of course this changes it for everyone.

I will write a plugin and then people can install it or not. I am definately not on my own with this issue.

I want the 'remember me' option on the admin , just got a few things to do first. I did have a quick look earlier and it should be a simple thing to do and should use the native remember me code but just on the admin.

Joomla 3 has it has 'Database'and 'PHP' session handler support. 'PHP' based uses PHP session cookies and these are subject to gargabage collection which on most servers is about every 24mins. In Joomla 4 it has 'Database' and 'File'. I do not know what 'file' is

[sozzled]

Fair enough; I sincerely wish you good luck. I agree that you're not alone in this but, as I mentioned earlier, there's already an alternative workaround that's existed ever since J! 1.0. That's what I use and I'm happy enough using that.

The maximum length of time I allow for a session (before it expires) for the frontend is 30 minutes. That's usually a sufficient amount of time for a frontend user to do what they need to do. AFAIK, the backend session length is hard-coded in the core (I could be mistaken); the Global Configuration options have no effect on the backend session length.

I haven't looked into the different session handler options for J! 4 because I use PHP 7 and it's more efficient on server resources AFAIC to set the session handler to "PHP".

[shoulders]

@sozzled

I will have a look at the code and see if these ajax calls are working. I mainly use K2 so it might be interesting to see if they use this method and if not, perhaps they should.

[ceford]

See this post for information on session handlers:

viewtopic.php?f=803&t=980886&p=3608571& ... r#p3608571

And the Session Lifetime is not hard coded in the backend - it works. I get logged out often, but logging in takes two seconds and does not bother me. I have mine set to 60 minutes.

[sozzled]

Thanks, @ceford, for the advice about the session length for the backend. I really can't remember how things have developed over all these years and, perhaps, in my long journey with J! it may simply be a matter of folklore that session lengths for front- and back-end seemed to operate differently (or inconsistently) and I found myself being logged-out from the backend earlier than I expected. Who knows?

In any case—like you—if I'm logged out from the backend, it only takes a second or two to login again and continue from where I left off without losing any work-in-progress. And, from either perspective—being logged-out (which is a minor nuisance, perhaps) or using the workaround I've mentioned previously—this is a non-issue in my opinion. For those reasons, the desirability (or perceived need) to have a "Remember me" checkbox on the backend login form would seem to be a purely cosmetic one.

I'm not standing in the way of any entrepreneurial developer from forging ahead to plonk another checkbox on the backend login form or, if people wish to have this feature, for people to use it. I wouldn't bother with it but, then again, this doesn't mean that people shouldn't be able to choose to use one if they feel more comfortable with it. I am saying, however, that I strongly doubt there's sufficient enthusiasm in the J! CMS development team to implement this kind of suggestion; after all, it's never been part of the backend for the entire duration of the J! project and I doubt it will get a guernsey in any future development of the J! core.

Cheers