cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
michaelgappa1
Frequent Visitor

Power Apps wCookie Management - ASP.NET SessionsID

Does anyone know or can confirm if the Session ID lifetime on any Power Apps Website can be adjusted? I have found documentation that says its lifetime is session (expires after browser is closed), but I haven't found anywhere that it cannot be adjusted?

Cookies in Power Apps portals - Power Apps | Microsoft Learn

1 ACCEPTED SOLUTION

Accepted Solutions
poweractivate
Most Valuable Professional
Most Valuable Professional

@michaelgappa1 

 

Please make a note of the following:

 

Although I do not know the internal implementation here of Portals or Office 365, note that regardless of the client side lifetime of any cookie, if there are any server side validation checks on the age of the cookie from when it was first made by the server's perspective, then one or more such cookies where such validation is performed, after expired on the server side, can no longer be used to perform any further operations regardless of the client side age of the cookie.

 

Let's suppose it does what you want and the age of every cookie were exactly what you wanted. However suppose the server did not care when any cookie expired. Couldn't you just take any cookie you wanted, and just change the age of it with any client side tool before it expired, and then just wait, and then the server would consider even an expired cookie as valid now? 

 

Actually, if a cookie's validation were modified on the client side to be longer, and the server still discarded it when it was actually past its real expiration date validated on the server, wouldn't it be a sign that the server was doing a better job in that case not relying just on the client side cookie's timestamps?

 

So I think reliance on just what the client side tells you of the cookie as a sign of the security strength of a system is not wise. A sign of a vulnerability may very well be the opposite of what you have noted. If all the cookies have all the right dates on your side, but never validates on the server, that's actually a real vulnerability, because you could just change when the cookies expire and that's all it would take to trigger a system vulnerability, right?

 

Out of curiosity, I would like to know where did you find out that the expiration date of a cookie alone taking into account no other factors, or the fact that a cookie persists for a whole browser session, alone and taking into account no other factors is a sign of any vulnerability. 

 

I don't know the internal implementation but I don't think you have much to worry about here.

If you are still concerned you can try to make a support ticket here:

Create a new Power Platform Support Ticket

However, I am not sure what you would put there because I didn't see any problem here in what you described.

 

View solution in original post

11 REPLIES 11
poweractivate
Most Valuable Professional
Most Valuable Professional

@michaelgappa1 

 

I believe the timeout for when someone is about to be signed out of Microsoft 365 (which I believe includes Power Apps and anything else they're logged into related to Microsoft 365) can be adjusted. See if below helps you:
Idle session timeout for Microsoft 365

 

I am not sure if this setting affects the sign out timeout of the Power Apps web application - you can try it to see.

I am also not 100% sure if there is a way to adjust the sign out timeout of only Power Apps in particular and nothing else.

michaelgappa1
Frequent Visitor

Thanks, I should have been clearer about what exactly I'm trying to do, sorry about that.

We're using Dynamics Online and we have a power apps portal we use publicly. When someone visits the portal, the cookie generated has an expiration of Session. I attached the image with the highlighted cookie for the particular website.

When I visit the website, it generates the cookie and only expires when you close the browser. That was highlighted as a security vulnerability, and they insisted on changing the lifetime on the cookie. Since its online, I'm assuming there's no way to change that, unless I'm mistaken.

poweractivate
Most Valuable Professional
Most Valuable Professional

@michaelgappa1 I think it is still possible, I might reply in a moment with how you can do it

poweractivate
Most Valuable Professional
Most Valuable Professional

@michaelgappa1 

 

1. Go to yourorg.crm.dynamics.com

2. On upper right notice the settings gear. Click it

3. Click Advanced Settings

poweractivate_0-1670522052486.png

 

4. Now click on the chevron to the right of Settings

poweractivate_0-1670521716903.png

5. Under System click Administration

poweractivate_1-1670521748841.png

6. Click System Settings

poweractivate_2-1670521788483.png

7. Scroll down to Set Session timeout and Set inactivity timeout and configure as desired.

For example click "Set custom" under Session timeout settings

poweractivate_3-1670521876358.png

8 .Configure the maximum session length and timeout warning values.

When done, click OK

poweractivate_4-1670521963310.png

 

See if it helps @michaelgappa1 

 

 

poweractivate
Most Valuable Professional
Most Valuable Professional

@michaelgappa1 

 

If you mean the Portal only try this:

 

Create two site settings in your Portal:

 

Name : Authentication/ApplicationCookie/ExpireTimeSpan
Value : Idle time in the format is in HH:MM:SS. For example, 30 seconds would be 00:00:30
Description: Idle time of the Portal

 

Name : Authentication/ApplicationCookie/LoginPath
Value : /SignIn
Description: This is where the user will be redirected to after the session timeout. You can, for example, create your own custom web page at this location also and then display a custom message for the session timeout on that page.

 

Does it help @michaelgappa1 ?

michaelgappa1
Frequent Visitor

Thanks, I tried this, but it looks like the ASP.NET SessionId still remains before and after user session. It's only when I close the entire browser session and revisit the portal does it change. 

poweractivate
Most Valuable Professional
Most Valuable Professional

@michaelgappa1 

 

Did it change though after you put those Portal settings and does it match the settings you put in?

 

If it did, I am not sure it is possible to apply them instantly, it may be only supported after you close the entire browser session and revisit the portal. If there was indeed some difference after the setting, after you close the entire browser session and revisit the portal, that means it may have worked.

 

Do you want me to check on if you need detail on how to destroy or invalidate all the Portal sessions if that may be something you need?

michaelgappa1
Frequent Visitor

After setting it to 30 seconds, I cleared by browser's cookies and closed the entire browser session. Then I visited the portal and confirmed the ASP.NET SessionID. Once I logged into the Portal, I confirmed it's the same SessionId prior to login. After 30 seconds, I attempted to navigate to another page and I see it logged me out, but the SessionId remains the same. 

As far as the portal sessions, that may be what I need to do. I did some research on ASP.NET_Session_ID and it seems if it's an ASP.NET application you developed using the framework (and not through Power Apps) you can add the script to your app to clear the session. I didn't think you can do that with Power App Portals. 

how to remove SessionID (microsoft.com)

poweractivate
Most Valuable Professional
Most Valuable Professional

@michaelgappa1 What happens when you try both ways, the System Settings and the Portal Settings, and you can try slightly different times as well so you could tell which timeout triggers in which case. Does it help?

 

Note that even if any specific cookie remains valid, whether it's the Office 365 one or the Portals one, there may be more than one cookie involved. If the correct cookies are invalidated and have the correct expiration, that session cookie is of no use anymore and cannot be used to perform any more operations against Office 365 services. If either or both methods cause the timeout to really work, any presence of any other cookies does not matter as I believe they cannot be used to make any further operations against any authenticated user.

 

Please clarify if you are more worried about the Office 365 services as a whole and how it handles cookies, or just your Power Apps portal in particular. I believe what I said applies to both, however you could continue to test and if you found any vulnerability or issue please give more detail in a reply which operation can still be performed against an authenticated user after the configured timeout was reached.

 

See if it helps @michaelgappa1 

Helpful resources

Announcements

Tuesday Tip: Getting Started with Private Messages & Macros

Welcome to TUESDAY TIPS, your weekly connection with the most insightful tips and tricks that empower both newcomers and veterans in the Power Platform Community! Every Tuesday, we bring you a curated selection of the finest advice, distilled from the resources and tools in the Community. Whether you’re a seasoned member or just getting started, Tuesday Tips are the perfect compass guiding you across the dynamic landscape of the Power Platform Community.   As our community family expands each week, we revisit our essential tools, tips, and tricks to ensure you’re well-versed in the community’s pulse. Keep an eye on the News & Announcements for your weekly Tuesday Tips—you never know what you may learn!   This Week's Tip: Private Messaging & Macros in Power Apps Community   Do you want to enhance your communication in the Community and streamline your interactions? One of the best ways to do this is to ensure you are using Private Messaging--and the ever-handy macros that are available to you as a Community member!   Our Knowledge Base article about private messaging and macros is the best place to find out more. Check it out today and discover some key tips and tricks when it comes to messages and macros:   Private Messaging: Learn how to enable private messages in your community profile and ensure you’re connected with other community membersMacros Explained: Discover the convenience of macros—prewritten text snippets that save time when posting in forums or sending private messagesCreating Macros: Follow simple steps to create your own macros for efficient communication within the Power Apps CommunityUsage Guide: Understand how to apply macros in posts and private messages, enhancing your interaction with the Community For detailed instructions and more information, visit the full page in your community today:Power Apps: Enabling Private Messaging & How to Use Macros (Power Apps)Power Automate: Enabling Private Messaging & How to Use Macros (Power Automate)  Copilot Studio: Enabling Private Messaging &How to Use Macros (Copilot Studio) Power Pages: Enabling Private Messaging & How to Use Macros (Power Pages)

April 4th Copilot Studio Coffee Chat | Recording Now Available

Did you miss the Copilot Studio Coffee Chat on April 4th? This exciting and informative session with Dewain Robinson and Gary Pretty is now available to watch in our Community Galleries!   This AMA discussed how Copilot Studio is using the conversational AI-powered technology to aid and assist in the building of chatbots. Dewain is a Principal Program Manager with Copilot Studio. Gary is a Principal Program Manager with Copilot Studio and Conversational AI. Both of them had great insights to share with the community and answered some very interesting questions!     As part of our ongoing Coffee Chat AMA series, this engaging session gives the Community the unique opportunity to learn more about the latest Power Platform Copilot plans, where we’ll focus, and gain insight into upcoming features. We’re looking forward to hearing from the community at the next AMA, so hang on to your questions!   Watch the recording in the Gallery today: April 4th Copilot Studio Coffee Chat AMA

Tuesday Tip: Subscriptions & Notifications

TUESDAY TIPS are our way of communicating helpful things we've learned or shared that have helped members of the Community. Whether you're just getting started or you're a seasoned pro, Tuesday Tips will help you know where to go, what to look for, and navigate your way through the ever-growing--and ever-changing--world of the Power Platform Community! We cover basics about the Community, provide a few "insider tips" to make your experience even better, and share best practices gleaned from our most active community members and Super Users.   With so many new Community members joining us each week, we'll also review a few of our "best practices" so you know just "how" the Community works, so make sure to watch the News & Announcements each week for the latest and greatest Tuesday Tips!   This Week: All About Subscriptions & Notifications We don't want you to a miss a thing in the Community! The best way to make sure you know what's going on in the News & Announcements, to blogs you follow, or forums and galleries you're interested in is to subscribe! These subscriptions ensure you receive automated messages about the most recent posts and replies. Even better, there are multiple ways you can subscribe to content and boards in the community! (Please note: if you have created an AAD (Azure Active Directory) account you won't be able to receive e-mail notifications.)   Subscribing to a Category  When you're looking at the entire category, select from the Options drop down and choose Subscribe.     You can then choose to Subscribe to all of the boards or select only the boards you want to receive notifications. When you're satisfied with your choices, click Save.   Subscribing to a Topic You can also subscribe to a single topic by clicking Subscribe from the Options drop down menu, while you are viewing the topic or in the General board overview, respectively.     Subscribing to a Label Find the labels at the bottom left of a post.From a particular post with a label, click on the label to filter by that label. This opens a window containing a list of posts with the label you have selected. Click Subscribe.           Note: You can only subscribe to a label at the board level. If you subscribe to a label named 'Copilot' at board #1, it will not automatically subscribe you to an identically named label at board #2. You will have to subscribe twice, once at each board.   Bookmarks Just like you can subscribe to topics and categories, you can also bookmark topics and boards from the same menus! Simply go to the Topic Options drop down menu to bookmark a topic or the Options drop down to bookmark a board. The difference between subscribing and bookmarking is that subscriptions provide you with notifications, whereas bookmarks provide you a static way of easily accessing your favorite boards from the My subscriptions area.   Managing & Viewing Your Subscriptions & Bookmarks To manage your subscriptions, click on your avatar and select My subscriptions from the drop-down menu.     From the Subscriptions & Notifications tab, you can manage your subscriptions, including your e-mail subscription options, your bookmarks, your notification settings, and your email notification format.     You can see a list of all your subscriptions and bookmarks and choose which ones to delete, either individually or in bulk, by checking multiple boxes.     A Note on Following Friends on Mobile Adding someone as a friend or selecting Follow in the mobile view does not allow you to subscribe to their activity feed. You will merely be able to see your friends’ biography, other personal information, or online status, and send messages more quickly by choosing who to send the message to from a list, as opposed to having to search by username.

Monthly Community User Group Update | April 2024

The monthly Community User Group Update is your resource for discovering User Group meetings and events happening around the world (and virtually), welcoming new User Groups to our Community, and more! Our amazing Community User Groups are an important part of the Power Platform Community, with more than 700 Community User Groups worldwide, we know they're a great way to engage personally, while giving our members a place to learn and grow together.   This month, we welcome 3 new User Groups in India, Wales, and Germany, and feature 8 User Group Events across Power Platform and Dynamics 365. Find out more below. New Power Platform User Groups   Power Platform Innovators (India) About: Our aim is to foster a collaborative environment where we can share upcoming Power Platform events, best practices, and valuable content related to Power Platform. Whether you’re a seasoned expert or a newcomer looking to learn, this group is for you. Let’s empower each other to achieve more with Power Platform. Join us in shaping the future of digital transformation!   Power Platform User Group (Wales) About: A Power Platform User Group in Wales (predominantly based in Cardiff but will look to hold sessions around Wales) to establish a community to share learnings and experience in all parts of the platform.   Power Platform User Group (Hannover) About: This group is for anyone who works with the services of Microsoft Power Platform or wants to learn more about it and no-code/low-code. And, of course, Microsoft Copilot application in the Power Platform.   New Dynamics365 User Groups   Ellucian CRM Recruit UK (United Kingdom) About: A group for United Kingdom universities using Ellucian CRM Recruit to manage their admissions process, to share good practice and resolve issues.    Business Central Mexico (Mexico City) About:  A place to find documentation, learning resources, and events focused on user needs in Mexico. We meet to discuss and answer questions about the current features in the standard localization that Microsoft provides, and what you only find in third-party locations. In addition, we focus on what's planned for new standard versions, recent legislation requirements, and more. Let's work together to drive request votes for Microsoft for features that aren't currently found—but are indispensable.   Dynamics 365 F&O User Group (Dublin) About: The Dynamics 365 F&O User Group - Ireland Chapter meets up in person at least twice yearly in One Microsoft Place Dublin for users to have the opportunity to have conversations on mutual topics, find out what’s new and on the Dynamics 365 FinOps Product Roadmap, get insights from customer and partner experiences, and access to Microsoft subject matter expertise.  Upcoming Power Platform Events    PAK Time (Power Apps Kwentuhan) 2024 #6 (Phillipines, Online) This is a continuation session of Custom API. Sir Jun Miano will be sharing firsthand experience on setting up custom API and best practices. (April 6, 2024)       Power Apps: Creating business applications rapidly (Sydney) At this event, learn how to choose the right app on Power Platform, creating a business application in an hour, and tips for using Copilot AI. While we recommend attending all 6 events in the series, each session is independent of one another, and you can join the topics of your interest. Think of it as a “Hop On, Hop Off” bus! Participation is free, but you need a personal computer (laptop) and we provide the rest. We look forward to seeing you there! (April 11, 2024)     April 2024 Cleveland Power Platform User Group (Independence, Ohio) Kickoff the meeting with networking, and then our speaker will share how to create responsive and intuitive Canvas Apps using features like Variables, Search and Filtering. And how PowerFx rich functions and expressions makes configuring those functionalities easier. Bring ideas to discuss and engage with other community members! (April 16, 2024)     Dynamics 365 and Power Platform 2024 Wave 1 Release (NYC, Online) This session features Aric Levin, Microsoft Business Applications MVP and Technical Architect at Avanade and Mihir Shah, Global CoC Leader of Microsoft Managed Services at IBM. We will cover some of the new features and enhancements related to the Power Platform, Dataverse, Maker Portal, Unified Interface and the Microsoft First Party Apps (Microsoft Dynamics 365) that were announced in the Microsoft Dynamics 365 and Power Platform 2024 Release Wave 1 Plan. (April 17, 2024)     Let’s Explore Copilot Studio Series: Bot Skills to Extend Your Copilots (Makati National Capital Reg... Join us for the second installment of our Let's Explore Copilot Studio Series, focusing on Bot Skills. Learn how to enhance your copilot's abilities to automate tasks within specific topics, from booking appointments to sending emails and managing tasks. Discover the power of Skills in expanding conversational capabilities. (April 30, 2024)   Upcoming Dynamics365 Events    Leveraging Customer Managed Keys (CMK) in Dynamics 365 (Noida, Uttar Pradesh, Online) This month's featured topic: Leveraging Customer Managed Keys (CMK) in Dynamics 365, with special guest Nitin Jain from Microsoft. We are excited and thankful to him for doing this session. Join us for this online session, which should be helpful to all Dynamics 365 developers, Technical Architects and Enterprise architects who are implementing Dynamics 365 and want to have more control on the security of their data over Microsoft Managed Keys. (April 11, 2024)     Stockholm D365 User Group April Meeting (Stockholm) This is a Swedish user group for D365 Finance and Operations, AX2012, CRM, CE, Project Operations, and Power BI.  (April 17, 2024)         Transportation Management in D365 F&SCM Q&A Session (Toronto, Online) Calling all Toronto UG members and beyond! Join us for an engaging and informative one-hour Q&A session, exclusively focused on Transportation Management System (TMS) within Dynamics 365 F&SCM. Whether you’re a seasoned professional or just curious about TMS, this event is for you. Bring your questions! (April 26, 2024)   Leaders, Create Your Events!    Leaders of existing User Groups, don’t forget to create your events within the Community platform. By doing so, you’ll enable us to share them in future posts and newsletters. Let’s spread the word and make these gatherings even more impactful! Stay tuned for more updates, inspiring stories, and collaborative opportunities from and for our Community User Groups.   P.S. Have an event or success story to share? Reach out to us – we’d love to feature you. Just leave a comment or send a PM here in the Community!

Exclusive LIVE Community Event: Power Apps Copilot Coffee Chat with Copilot Studio Product Team

We have closed kudos on this post at this time. Thank you to everyone who kudo'ed their RSVP--your invitations are coming soon!  Miss the window to RSVP? Don't worry--you can catch the recording of the meeting this week in the Community.  Details coming soon!   *****   It's time for the SECOND Power Apps Copilot Coffee Chat featuring the Copilot Studio product team, which will be held LIVE on April 3, 2024 at 9:30 AM Pacific Daylight Time (PDT).     This is an incredible opportunity to connect with members of the Copilot Studio product team and ask them anything about Copilot Studio. We'll share our special guests with you shortly--but we want to encourage to mark your calendars now because you will not want to miss the conversation.   This live event will give you the unique opportunity to learn more about Copilot Studio plans, where we’ll focus, and get insight into upcoming features. We’re looking forward to hearing from the community, so bring your questions!   TO GET ACCESS TO THIS EXCLUSIVE AMA: Kudo this post to reserve your spot! Reserve your spot now by kudoing this post.  Reservations will be prioritized on when your kudo for the post comes through, so don't wait! Click that "kudo button" today.   Invitations will be sent on April 2nd.Users posting Kudos after April 2nd. at 9AM PDT may not receive an invitation but will be able to view the session online after conclusion of the event. Give your "kudo" today and mark your calendars for April 3rd, 2024 at 9:30 AM PDT and join us for an engaging and informative session!

Tuesday Tip: Blogging in the Community is a Great Way to Start

TUESDAY TIPS are our way of communicating helpful things we've learned or shared that have helped members of the Community. Whether you're just getting started or you're a seasoned pro, Tuesday Tips will help you know where to go, what to look for, and navigate your way through the ever-growing--and ever-changing--world of the Power Platform Community! We cover basics about the Community, provide a few "insider tips" to make your experience even better, and share best practices gleaned from our most active community members and Super Users.   With so many new Community members joining us each week, we'll also review a few of our "best practices" so you know just "how" the Community works, so make sure to watch the News & Announcements each week for the latest and greatest Tuesday Tips!   This Week's Topic: Blogging in the Community Are you new to our Communities and feel like you may know a few things to share, but you're not quite ready to start answering questions in the forums? A great place to start is the Community blog! Whether you've been using Power Platform for awhile, or you're new to the low-code revolution, the Community blog is a place for anyone who can write, has some great insight to share, and is willing to commit to posting regularly! In other words, we want YOU to join the Community blog.    Why should you consider becoming a blog author? Here are just a few great reasons. 🎉   Learn from Each Other: Our community is like a bustling marketplace of ideas. By sharing your experiences and insights, you contribute to a dynamic ecosystem where makers learn from one another. Your unique perspective matters! Collaborate and Innovate: Imagine a virtual brainstorming session where minds collide, ideas spark, and solutions emerge. That’s what our community blog offers—a platform for collaboration and innovation. Together, we can build something extraordinary. Showcase the Power of Low-Code: You know that feeling when you discover a hidden gem? By writing about your experience with your favorite Power Platform tool, you’re shining a spotlight on its capabilities and real-world applications. It’s like saying, “Hey world, check out this amazing tool!” Earn Trust and Credibility: When you share valuable information, you become a trusted resource. Your fellow community members rely on your tips, tricks, and know-how. It’s like being the go-to friend who always has the best recommendations. Empower Others: By contributing to our community blog, you empower others to level up their skills. Whether it’s a nifty workaround, a time-saving hack, or an aha moment, your words have impact. So grab your keyboard, brew your favorite beverage, and start writing! Your insights matter and your voice counts! With every blog shared in the Community, we all do a better job of tackling complex challenges with gusto. 🚀   Welcome aboard, future blog author! ✍️✏️🌠 Get started blogging across the Power Platform Communities today! Just follow one of the links below to begin your blogging adventure.   Power Apps: https://powerusers.microsoft.com/t5/Power-Apps-Community-Blog/bg-p/PowerAppsBlog Power Automate: https://powerusers.microsoft.com/t5/Power-Automate-Community-Blog/bg-p/MPABlog Copilot Studio: https://powerusers.microsoft.com/t5/Copilot-Studio-Community-Blog/bg-p/PVACommunityBlog Power Pages: https://powerusers.microsoft.com/t5/Power-Pages-Community-Blog/bg-p/mpp_blog   When you follow the link, look for the Message Admins button like this on the page's right rail, and let us know you're interested. We can't wait to connect with you and help you get started. Thanks for being part of our incredible community--and thanks for becoming part of the community blog!

Top Solution Authors
Top Kudoed Authors
Users online (6,421)