TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Session timeout value must be between 0-604800 seconds.

Error message

Session timeout value must be between 0-604800 seconds.

What it means

Thrown by the User.SessionTimeoutSeconds setter when value is negative or greater than 604800 (exactly 7 days). The bounds protect against nonsensical session lifetimes; values between 1 and 59 are silently bumped to 60 (a floor to avoid premature expiry), and 0 means no timeout. ArgumentOutOfRangeException signals the caller passed an out-of-range value.

Source

Thrown at DnsServerCore/Auth/User.cs:487

        public AuthenticatorKeyUri TOTPKeyUri
        { get { return _totpKeyUri; } }

        public bool TOTPEnabled
        { get { return _totpEnabled; } }

        public bool Disabled
        {
            get { return _disabled; }
            set { _disabled = value; }
        }

        public int SessionTimeoutSeconds
        {
            get { return _sessionTimeoutSeconds; }
            set
            {
                if ((value < 0) || (value > 604800))
                    throw new ArgumentOutOfRangeException(nameof(SessionTimeoutSeconds), "Session timeout value must be between 0-604800 seconds.");

                if ((value > 0) && (value < 60))
                    value = 60; //to prevent issues with too low timeout set by mistake

                _sessionTimeoutSeconds = value;
            }
        }

        public DateTime PreviousSessionLoggedOn
        { get { return _previousSessionLoggedOn; } }

        public IPAddress PreviousSessionRemoteAddress
        { get { return _previousSessionRemoteAddress; } }

        public DateTime RecentSessionLoggedOn
        { get { return _recentSessionLoggedOn; } }

        public IPAddress RecentSessionRemoteAddress

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Clamp the value to [0, 604800] before assigning, or validate and warn the user.
2. Make sure the UI/API clearly labels the field as seconds and constrains the input range.
3. If exposing days/hours in the UI, convert to seconds with a unit-aware helper.

Example fix

// before
user.SessionTimeoutSeconds = requested;

// after
user.SessionTimeoutSeconds = Math.Clamp(requested, 0, 604800);

const int MIN = 0, MAX = 604800;
if (requested < MIN || requested > MAX)
    return BadRequest($"Session timeout must be between {MIN} and {MAX} seconds.");
user.SessionTimeoutSeconds = requested;

static bool IsValidSessionTimeout(int value) => value >= 0 && value <= 604800;

When it happens

Trigger: Setting user.SessionTimeoutSeconds to a value < 0 or > 604800 — e.g. a config UI that accepts a number of hours/days and multiplies incorrectly, or an admin typing seconds-as-hours.

Common situations: Unit confusion (passing hours or days where seconds are expected); a slider/spinner with no upper bound; importing a config with a garbage large number.

Understand the failure class

• Timeouts: ETIMEDOUT, deadlines, and hung requests — what actually expires when a request times out.

Related errors

• Token name length cannot exceed 255 characters.
• Invalid time-based one-time password (TOTP) was attempted fo
• Display name length cannot exceed 255 characters.
• Invalid data or version not supported.
• Already logged in. Please create a new object to use a diffe

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/26dd0ff39f4927b6. Report an issue: GitHub.