Limit HTTP session lifetime

Current Behaviour

• HTTP sessions are closed when idle for 1 hour. This applies to sessions created by the JOC Cockpit Proxy Service with the Controller and it applies to sessions created by the Controller with the Agent.
• Sessions are closed automatically on logout. The session idle timeout applies to idle sessions and in case that the client is terminated before being able to terminate the session.

New Behaviour

• HTTP sessions are closed after 1 hour independently from the fact if the session was idle or not .
• This conforms to the OWASP recommendation for a max. session lifetime.

JS7 clients handle session timeouts automatically and re-login when required.