Conversation
The session lifetime was a compile-time constant in the shared dolphinscheduler-common module, which forced a rebuild and a replacement of the jars consumed by master, worker and alert to change a setting that only concerns the API server. Being a static final int, it was also inlined into SessionServiceImpl, so editing the constant alone was not enough. Move it to ApiConfig as a Duration defaulting to 2h, keeping the existing behaviour when the property is unset, and expose it as api.session-timeout so operators can tune it from api-server/conf/application.yaml. Expiry semantics are unchanged: the timeout is still measured from the moment the user logs in.
fuchanghai
force-pushed
the
improvement/session-timeout-configurable
branch
from
September 17, 2026 12:12
db60fb3 to
b428e2d
Compare
…out docs The Chinese configuration table row added for api.session-timeout was not padded to the flexmark-computed column width, so spotless:check failed and took the Docs, Backend-Build and Build CI jobs down with it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose of the pull request
Closes #18652.
The login session lifetime is hardcoded as
Constants.SESSION_TIME_OUT = 7200, so operators cannot adjust it without patching the source and rebuilding. This PR moves it intoApiConfigand exposes it asapi.session-timeout.Brief change log
dolphinscheduler-api/.../api/configuration/ApiConfig.javaDuration sessionTimeout(default2h), validate that it is positive, and log it inprintConfig.dolphinscheduler-api/.../api/service/impl/SessionServiceImpl.javaisSessionExpirereadsapiConfig.getSessionTimeout()instead of the constant.dolphinscheduler-common/.../common/constants/Constants.javaSESSION_TIME_OUT.dolphinscheduler-api/src/main/resources/application.yaml,dolphinscheduler-standalone-server/src/main/resources/application.yamlapi.session-timeout.SessionServiceTestgains anApiConfigspy plus a case covering the configured timeout;LoginControllerTestderives the expired timestamp from the config.api.session-timeoutrow.Root cause / motivation
Two problems with the constant approach:
static final int, so it is inlined intoSessionServiceImplat compile time. Editing the constant alone has no effect —dolphinscheduler-apimust be recompiled as well.dolphinscheduler-common, which is a jar shared by master / worker / alert / tools. Changing it forces all of those services to be replaced for what is purely an API-server concern.Behaviour
Unchanged by default: the field defaults to 2 hours, so deployments that do not set the property keep the current behaviour exactly.
Operators can now set, in
api-server/conf/application.yaml:Verify this change
Unit tests pass:
The new case
SessionServiceTest#testIsSessionExpireUsesConfiguredTimeoutsets a 1-hour timeout and asserts a 30-minute-old session is alive while a 90-minute-old one has expired. Verified end-to-end on a 3.4.2 deployment: settingapi.session-timeout: 12hkeeps a session alive past the previous 2-hour limit, and the startup log shows the parsed value (API config: sessionTimeout -> PT12H).Pull Request Type
Does this pull request potentially affect one of the following parts
AI usage disclosure
Checklist