In which cases does TypeType auto log-out a user?

[Toni-Vide]

Hey all,

one thing I am noticing is that after a certain amount of time, the user gets automatically logged out (maybe its 1 hour of inactivity, I am not sure yet). Is there a way to extend the log in duration? I checked the admin tools but could not find out any corresponding setting. Maybe I am missing it. Normally I would expect that there is "remember me" feature in case the app does apply such a policy (unless the app contains sensitive info like a banking app). The issue is I normally setup strong user passwords and dont save passwords on my devices, so logging in means that I have to rely on my password manager, that I may or may not have access to when I need to log in again.

Thank you for any help!

EDIT:

I initially assumed that one gets automatically logged out due to inactivity, but I also see that sometimes while watching a video I am no longer singed in, while I clearly logged in some time before.

[Priveetee]

Mmmmm no, this is not supposed to happen. TypeType does not automatically log users out because of inactivity.

The access token lasts one hour, but the session should refresh automatically and remain valid for thirty days. So if it happens after roughly one hour, the refresh is probably failing somewhere.

Ur edit is useful because if it also happens while watching, then it is clearly not an inactivity policy. I also noticed that the frontend currently clears the session too quickly when a refresh fails, even if it is only a temporary network problem.

If u can share ur setup, especially whether u use HTTP or HTTPS, ur browser/PWA and ur reverse proxy, it would help me reproduce it properly.

I’ll investigate this because u definitely should not have to enter ur password again every hour.

[Toni-Vide]

Hi @Priveetee

Here you go, do tell me if I am missing something or if you need more info:

1. No reverse proxy
2. Brave browser
3. HTTP (necessary since I dont have a certificate)

Beyond that I am selfhosting via a Synology NAS container manager.

[Priveetee]

Thx for the details, I found the cause!

TypeType currently uses a secure refresh cookie, which Brave will not store over plain HTTP. That explains why the session stops refreshing after around one hour.

HTTP installations are not supported for persistent sessions yet, but I will add a dedicated compatibility option in a future update. This will keep HTTPS as the secure default while allowing HTTP explicitly when needed.

For now, HTTPS is required for persistent login. Thx for reporting this setup!