When Sling receiving a request from any submitted form it parses it in two phases:

1.  Sling get raw input data and identity transform bytes to chars as the original data was in ISO-8859-1 encoding.
2. Locates _charset_ parameter which should be specified in every submitted form. This parameter specify form data original encoding. On second phase encoding will be resolved as:
   1. All names of the parameters are re-encoded
   2. The parameter values are re-encoded, unless the parameter value is an uploaded file. Actually the parameter (not the files of course) are internally as byte[]() where the conversion to a string is done on the fly (and yes, the conversion using the _charset_ character encoding is of course cached for performance reasons)
   3. If the parameter is an uploaded file, the file name is re-encoded on the fly when accessed

Good news that _charset_ parameter in Sling up to 2.2.4 is optional, so we can omit it. In this case second phase will resolve encoding based on sling.default.parameter.encoding property within org.apache.sling.engine.impl.SlingMainServlet.

Note: if sling.default.parameter.encoding wasn’t specified – second phase wouldn’t be reached and all not ASCII submitted text data will be encoded incorrectly.

For configuration sling.default.parameter.encoding we should open /system/console/configMgr/org.apache.sling.engine.parameters and set appropriate Default Parameter Encoding value:

When user request the site Sling back-end will instantiate a new session for it or using previously opened (Of cause this is a common case for application server). But a lot of opened sessions can impact performance therefore not active sessions must be closed. Time of inactivity depends on business requirements. For close user session after inactivity we should:

1.  Open configuration path:

   /system/console/configMgr/org.apache.jackrabbit.oak.security.authentication.token.TokenConfigurationImpl

2. Set appropriate value for Token Expiration property (Expiration time of login tokens in ms.)