Sessions and remember me

flowchart TD
    A[Successful password login] --> B{Remember me checked?}
    B -->|no| C[Absolute limit: expiration]
    C --> D[Idle limit: inactivity]
    B -->|yes| E[Absolute limit: remember_me]
    E --> F[Inactivity check bypassed]
    C --> G[Sign in again when either limit ends]
    D --> G
    F --> H[Sign in again at remembered expiry or after logout]

Status and exact values

Setting	Before, until 2026-08-27	Now applied	Plain meaning
expiration	1h	24h	Maximum lifetime when remember me is unticked
inactivity	5m	12h	Idle timeout when remember me is unticked
remember_me	1M	1y	Maximum lifetime when remember me is ticked

• live source:
  • /home/loca/dev/services/authelia/config/configuration.yml
• applied proof:
  • authelia config validate reported Configuration parsed and loaded successfully without errors.
  • the container was restarted and returned Up (healthy)
  • no error or warning lines appeared in the restart window

Critical behavior: remembered sessions ignore inactivity

• when remember me is unticked:
  • the session can live for at most 24h
  • 12h without activity ends it sooner
  • practical limit is whichever happens first
• when remember me is ticked:
  • the session can live for 1y
  • Authelia bypasses the inactivity check for that remembered session
  • inactivity: 12h does not shorten the remembered session
• consequence of the live default-on checkbox:
  • remember me is now pre-checked on first load
  • the practical session length is 1y unless the user unticks the box
  • this is convenient on a trusted machine and risky on a shared or lost machine
  • sign out when leaving an untrusted machine
• implementation proof:
  • Authelia returns early from inactivity validation when KeepMeLoggedIn is true in v4.39.20 session authorization code

Why JavaScript is required for default-on

• upstream behavior:
  • Authelia renders the checkbox only when remember me is enabled
  • its React state is initialized with useState(false) every time
  • the input is input#remember-checkbox with value rememberMe
  • proof: v4.39.20 first-factor form state and checkbox input
• configuration limit:
  • Authelia has no setting that makes this checkbox checked by default
• applied workaround:
  • Nginx injects same-origin /portal-remember.js
  • the script turns the existing React-controlled checkbox on
  • the control remains visible so a user can untick it
  • this is an unsupported-by-upstream portal workaround, not an Authelia configuration feature

Global values and cookie overrides

• live configuration:
  • global values appear directly under session:
  • the loca.zone item under session.cookies[] does not override any duration
  • therefore that cookie inherits the global values
• supported model:
  • session.expiration, session.inactivity, and session.remember_me supply defaults
  • each session.cookies[] entry can override those three values
  • non-positive per-cookie values inherit the global value
  • proof: v4.39.20 session validator and remember-me inheritance

Special values that are easy to get wrong

• remember_me: -1:
  • disables remember me
• remember_me: 0:
  • does not disable remember me
  • resets the global value to Authelia’s 30-day / one-month default
• global expiration or inactivity at zero or below:
  • reset to 1h and 5m
• validator relationship:
  • no v4.39.20 rule requires remember_me to be greater than inactivity
  • no documented maximum was found
  • a syntactically accepted long duration still needs a human security decision
• proof:
  • v4.39.20 default and disable logic

Official reference

• Authelia session configuration
  • expiration: normal cookie lifetime
  • inactivity: idle lifetime
  • remember_me: remembered cookie lifetime and override for expiration