Last Modified: Oct 09, 2026
Affected Product(s):
F5OS Velos
Known Affected Versions:
F5OS-A 1.5.0, F5OS-A 1.5.1, F5OS-A 1.5.2, F5OS-A 1.5.3, F5OS-A 1.5.4, F5OS-A 1.5.4-HR1, F5OS-A 1.5.4-HR2
Opened: Sep 06, 2023 Severity: 3-Major
If the GUI is not used for long durations while troubleshooting or long build sessions, it may time out and you will be logged out. You are unable to configure this timeout.
GUI Timeouts can interfere with external automation.
No user interaction with GUI over long durations result in GUI timeouts.
The current session works in the following fashion: User logs in with username and password and on clicking login the RESTCONF API call for the ‘/api’ endpoint is made which gets the token in response header. The token is valid for configured token lifetime (default 15 mins) and has 5 renewals possible. For further API calls this token is used. When there is <=30% time left for a token to expire, any API call made will return a renewed token which is again valid for the same duration (15 mins default). As we make the heartbeat calls to /api every 15 seconds, the token always gets renewed before expiry. So, we get all 5 renewals, even if the device is idle. When the last token which cannot be further renewed is about to expire in 10 seconds, user sees a countdown ticker on the GUI and is logged out of the application. With the 5 renewals for the default token lifetime of 15 minutes, user gets almost a 1-hour long session on the GUI. If it is configured to a different value, the session duration will vary accordingly. The maximum value for token lifetime is 1440 minutes i.e. 24 hours.
None