{"record":{"id":"26dd0ff39f4927b6","repo":"TechnitiumSoftware/DnsServer","slug":"session-timeout-value-must-be-between-0-604800-sec","errorCode":null,"errorMessage":"Session timeout value must be between 0-604800 seconds.","messagePattern":"Session timeout value must be between 0-604800 seconds\\.","errorType":"validation","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Auth/User.cs","lineNumber":487,"sourceCode":"        public AuthenticatorKeyUri TOTPKeyUri\n        { get { return _totpKeyUri; } }\n\n        public bool TOTPEnabled\n        { get { return _totpEnabled; } }\n\n        public bool Disabled\n        {\n            get { return _disabled; }\n            set { _disabled = value; }\n        }\n\n        public int SessionTimeoutSeconds\n        {\n            get { return _sessionTimeoutSeconds; }\n            set\n            {\n                if ((value < 0) || (value > 604800))\n                    throw new ArgumentOutOfRangeException(nameof(SessionTimeoutSeconds), \"Session timeout value must be between 0-604800 seconds.\");\n\n                if ((value > 0) && (value < 60))\n                    value = 60; //to prevent issues with too low timeout set by mistake\n\n                _sessionTimeoutSeconds = value;\n            }\n        }\n\n        public DateTime PreviousSessionLoggedOn\n        { get { return _previousSessionLoggedOn; } }\n\n        public IPAddress PreviousSessionRemoteAddress\n        { get { return _previousSessionRemoteAddress; } }\n\n        public DateTime RecentSessionLoggedOn\n        { get { return _recentSessionLoggedOn; } }\n\n        public IPAddress RecentSessionRemoteAddress","sourceCodeStart":469,"sourceCodeEnd":505,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/User.cs#L469-L505","documentation":"Thrown by the User.SessionTimeoutSeconds setter when value is negative or greater than 604800 (exactly 7 days). The bounds protect against nonsensical session lifetimes; values between 1 and 59 are silently bumped to 60 (a floor to avoid premature expiry), and 0 means no timeout. ArgumentOutOfRangeException signals the caller passed an out-of-range value.","triggerScenarios":"Setting user.SessionTimeoutSeconds to a value < 0 or > 604800 — e.g. a config UI that accepts a number of hours/days and multiplies incorrectly, or an admin typing seconds-as-hours.","commonSituations":"Unit confusion (passing hours or days where seconds are expected); a slider/spinner with no upper bound; importing a config with a garbage large number.","solutions":["Clamp the value to [0, 604800] before assigning, or validate and warn the user.","Make sure the UI/API clearly labels the field as seconds and constrains the input range.","If exposing days/hours in the UI, convert to seconds with a unit-aware helper."],"exampleFix":"// before\nuser.SessionTimeoutSeconds = requested;\n\n// after\nuser.SessionTimeoutSeconds = Math.Clamp(requested, 0, 604800);","handlingStrategy":"validation","validationCode":"const int MIN = 0, MAX = 604800;\nif (requested < MIN || requested > MAX)\n    return BadRequest($\"Session timeout must be between {MIN} and {MAX} seconds.\");\nuser.SessionTimeoutSeconds = requested;","typeGuard":"static bool IsValidSessionTimeout(int value) => value >= 0 && value <= 604800;","tryCatchPattern":null,"preventionTips":["Clearly label the field as seconds in the UI.","Clamp or reject out-of-range values before assignment.","Convert days/hours to seconds with a unit-aware helper to avoid confusion."],"tags":["auth","session","validation","range","technitium-dns-server"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}