UI should warn that token is near expiry

[RRcwhiting]

Is your feature request related to a problem? Please describe.
My team is frustrated when their work gets eaten by Vault midway through working on a large secret.

Describe the solution you'd like
The UI should warn you how long your session is remaining.

Describe alternatives you've considered
Token describe capability on the GUI would be nice, but requiring a user to use the console inspector is bad UX.

Explain any additional use-cases
diagnosing the default login TTL, etc

[Monkeychip]

@RRcwhiting thank you for the issue. Can you clarify what you mean by session? I just want to make sure I'm understanding correctly. Are you referring to a token's duration?

[RRcwhiting]

The GUI sessions, in the web interface.

[Monkeychip]

@RRcwhiting got it. It does look like we can make a request to the auth/token/lookup endpoint and retrieve the users/tokens expiry information. We're going to bring this idea to design. No promises, but I also agree it would be helpful to display some kind of warning/banner.

[Edited: removed due to incorrect information].

[maxb]

This param is called the token_period.

@Monkeychip The token_period setting is actually used to create periodic tokens, a special and usually rare kind of token that can never expire provided it is repeatedly renewed within its period.

Standard use-cases just wanting to manage the initial default, and maximum requestable/renewable lifetime, of tokens should be looking at the token_ttl and token_max_ttl settings instead.

[Monkeychip]

@maxb Thank you! Yes. That's correct. My apologies.

[hashishaw]

Hi @RRcwhiting! I've opened #23143 to show an expiration warning, which I'd love your feedback on whether you think this approach would solve your painpoint. There are a couple limitations in the current approach:

• Will only show the warning if the token is renewable.
• Will only show the warning if the user has been "inactive" (see PR for more details). This means that if the user is coming up on their max TTL but has been active in the UI, we will not show the warning.

Addressing the above limitations is possible but will take more time. I wanted to check with you to get a sense if this partial fix will address most of your team's concerns.

I'm also curious about this statement:

Token describe capability on the GUI would be nice

Where in the GUI would you expect the information to display? We could use the /auth/token/lookup-self endpoint and show some of it under the user menu, or maybe there's a new page you had in mind?

[RRcwhiting]

if the user is active in the UI, they're working on something and honestly would probably want to be notified they're about to have a session expire.

a good test case is a veeeeery long secret file. copying and pasting things into it. it's not technically saving things in the UI, but the mouse is moving.

[hashishaw]

a good test case is a veeeeery long secret file. copying and pasting things into it. it's not technically saving things in the UI, but the mouse is moving.

Filling in inputs will not trigger "activity" until the secret is saved, so it should show the warning in that case. I will go ahead and move forward with the PR, and as things can be improved more we can open new issues to address those. How does that sound?

[RRcwhiting]

if it still eats their homework I still have the same problem.

do what you want :)

[hashishaw]

right, that's why I'm trying to fully understand your situation :)

From what I can tell, it sounds like they are bumping up against the inactivity timeout. My PR will help surface the fact that the token is no longer being auto-renewed, but they will still have to click "Renew token" from the user dropdown in order to not lose their work (this functionality is available today). As interim pain reduction, I might recommend your users go ahead and renew their token before they take on a large form.

If they are instead getting kicked out due to their session exceeding the max TTL, my PR won't really help. In that case, I would recommend increasing the max TTL for the auth method or opening a new ticket with the expectation that the user should know when their session is approaching the max TTL.

Hope that helps!

[hashishaw]

Added a session timeout warning for 1.15.2 👍