When user request the site Sling back-end will instantiate a new session for it or using previously opened (Of cause this is a common case for application server). But a lot of opened sessions can impact performance therefore not active sessions must be closed. Time of inactivity depends on business requirements. For close user session after inactivity we should:
- Open configuration path:
/system/console/configMgr/org.apache.jackrabbit.oak.security.authentication.token.TokenConfigurationImpl
- Set appropriate value for Token Expiration property (Expiration time of login tokens in ms.)
