[FEATURE] Allow automatic session renewals #475
Description
I want to put SilverBullet behind Tinyauth. But because TinyAuth doesn't automatically renew sessions with the Traefik forwardAuth. This sometimes results in SilverBullet's sync breaking mid-way through an initially valid session.
Activity
steveiliop56 commentedon Nov 23, 2025
Planned for v5 : )
steveiliop56 commentedon Dec 23, 2025
Initial implementation at #540.
steveiliop56 commentedon Dec 26, 2025
Implemented in #540. If the session is active (requests are being made) and it expires in less than an hour, we constantly "refresh" the expiry back to one hour until the user exits and the session finally expires.
mufeedali commentedon Dec 27, 2025
Nice! Thanks!
jo-chemla commentedon Dec 27, 2025
Nice to see the PR for this feature! How will the one hour session refresh be user controlled? Can it be edited via env? Thanks!
steveiliop56 commentedon Dec 27, 2025
The session is automatically renewed as long as requests are being made. This will work for something like web sockets which make constant requests but it won't work for something that makes very occasional requests because there isn't any way to know if the user is active (although doubt that there is any app that won't make any request in a span of a few minutes). There is no option to control for how long the session will be renewed for because I don't think there is a reason for the user to need to modify that. Keep in mind that once the session starts the refresh process (so it gets refreshed right before it expires) it's practically semi-expired and it will end once the active session refreshing it expires and thus the one hour runs out.
jo-chemla commentedon Dec 28, 2025
Thanks for getting back so fast.
This great article mentions
idle, renewal and absolute timeouts. My question was whether it was possible with tinyauth to set this renewal timeout to either 10min for sensitive apps, or 1 week or 1 months for less sensitive ones.steveiliop56 commentedon Dec 30, 2025
Right now it's not possible but could be added in the future although I do believe it's a bit of niche use case.