Power Apps wCookie Management - ASP.NET SessionsID

[michaelgappa1]

Does anyone know or can confirm if the Session ID lifetime on any Power Apps Website can be adjusted? I have found documentation that says its lifetime is session (expires after browser is closed), but I haven't found anywhere that it cannot be adjusted?

Cookies in Power Apps portals - Power Apps | Microsoft Learn

[poweractivate]

@michaelgappa1 

I believe the timeout for when someone is about to be signed out of Microsoft 365 (which I believe includes Power Apps and anything else they're logged into related to Microsoft 365) can be adjusted. See if below helps you:
Idle session timeout for Microsoft 365

I am not sure if this setting affects the sign out timeout of the Power Apps web application - you can try it to see.

I am also not 100% sure if there is a way to adjust the sign out timeout of only Power Apps in particular and nothing else.

[michaelgappa1]

Thanks, I should have been clearer about what exactly I'm trying to do, sorry about that.

We're using Dynamics Online and we have a power apps portal we use publicly. When someone visits the portal, the cookie generated has an expiration of Session. I attached the image with the highlighted cookie for the particular website.

When I visit the website, it generates the cookie and only expires when you close the browser. That was highlighted as a security vulnerability, and they insisted on changing the lifetime on the cookie. Since its online, I'm assuming there's no way to change that, unless I'm mistaken.

[poweractivate]

@michaelgappa1 I think it is still possible, I might reply in a moment with how you can do it

[poweractivate]

@michaelgappa1 

1. Go to yourorg.crm.dynamics.com

2. On upper right notice the settings gear. Click it

3. Click Advanced Settings

4. Now click on the chevron to the right of Settings

5. Under System click Administration

6. Click System Settings

7. Scroll down to Set Session timeout and Set inactivity timeout and configure as desired.

For example click "Set custom" under Session timeout settings

8 .Configure the maximum session length and timeout warning values.

When done, click OK

See if it helps @michaelgappa1 

[poweractivate]

@michaelgappa1 

If you mean the Portal only try this:

Create two site settings in your Portal:

Name : Authentication/ApplicationCookie/ExpireTimeSpan
Value : Idle time in the format is in HH:MM:SS. For example, 30 seconds would be 00:00:30
Description: Idle time of the Portal

Name : Authentication/ApplicationCookie/LoginPath
Value : /SignIn
Description: This is where the user will be redirected to after the session timeout. You can, for example, create your own custom web page at this location also and then display a custom message for the session timeout on that page.

Does it help @michaelgappa1 ?

[michaelgappa1]

Thanks, I tried this, but it looks like the ASP.NET SessionId still remains before and after user session. It's only when I close the entire browser session and revisit the portal does it change. 

[poweractivate]

@michaelgappa1 

Did it change though after you put those Portal settings and does it match the settings you put in?

If it did, I am not sure it is possible to apply them instantly, it may be only supported after you close the entire browser session and revisit the portal. If there was indeed some difference after the setting, after you close the entire browser session and revisit the portal, that means it may have worked.

Do you want me to check on if you need detail on how to destroy or invalidate all the Portal sessions if that may be something you need?

[michaelgappa1]

After setting it to 30 seconds, I cleared by browser's cookies and closed the entire browser session. Then I visited the portal and confirmed the ASP.NET SessionID. Once I logged into the Portal, I confirmed it's the same SessionId prior to login. After 30 seconds, I attempted to navigate to another page and I see it logged me out, but the SessionId remains the same. 

As far as the portal sessions, that may be what I need to do. I did some research on ASP.NET_Session_ID and it seems if it's an ASP.NET application you developed using the framework (and not through Power Apps) you can add the script to your app to clear the session. I didn't think you can do that with Power App Portals. 

how to remove SessionID (microsoft.com)

[poweractivate]

@michaelgappa1 What happens when you try both ways, the System Settings and the Portal Settings, and you can try slightly different times as well so you could tell which timeout triggers in which case. Does it help?

Note that even if any specific cookie remains valid, whether it's the Office 365 one or the Portals one, there may be more than one cookie involved. If the correct cookies are invalidated and have the correct expiration, that session cookie is of no use anymore and cannot be used to perform any more operations against Office 365 services. If either or both methods cause the timeout to really work, any presence of any other cookies does not matter as I believe they cannot be used to make any further operations against any authenticated user.

Please clarify if you are more worried about the Office 365 services as a whole and how it handles cookies, or just your Power Apps portal in particular. I believe what I said applies to both, however you could continue to test and if you found any vulnerability or issue please give more detail in a reply which operation can still be performed against an authenticated user after the configured timeout was reached.

See if it helps @michaelgappa1