how to force Bitbucket dashboard session logout after x time of inactivity.

[Diju S Nair]

We are upgrading BBDC from 6.9 to 8.9 and as per the security recommendation we need to implement the session timeout to 15 min.
We have removed the "keep me logged in" and impemened "server.session.timeout" to 15 min, but it only logs out if the browser is closed and if the browser/Tab is open(without any activity), it will not log out even after 15-20 min.
Can i know if there is any solution for this?

[Victor Menes]

Hey Diju,

Thank you for submitting your doubt here :)

I will try to give you useful information so you could get this sorted out. Below are a couple possible causes for the issue you've reported. Additional information can be found here as well - Bitbucket Server Session does not expire after configured timeout 

• The login screen might have the "remember me" checkbox marked.
• If using clustering, each node has it's own web.xml and changes may not be in sync.
• The load balancer has session affinity enabled
• The user may be active the entire time which will cause them to not be logged out

Would you be able to take a look on these and see if that helps?