The host of a client is claiming the call to getAuthTimeout is triggering their firewall, and in turn blocks my client from accessing their site for a longer duration.

Is there a way to disable or change the interval?

  • 2
    An extra request every 60 seconds is above their threshold?
    – Brad Bell
    Commented Mar 10, 2016 at 18:17
  • @ Brad: seriously. An extra getAuthTimeout every minute? If a company is that concerned about security, they should whitelist the remote IP. Or use a remote VPN connection. I've gotten brute force attempts on my WP installs at 500+/requests second. Commented Mar 11, 2016 at 0:15
  • Well, I forgot to mention that the support person said it was triggering every couple milliseconds, which I have no reason to believe is true. I've asked them for logs and more details, but in general they have been very vague and incompetent in their answers, so I don't know what to believe. Commented Mar 11, 2016 at 12:27

2 Answers 2


Unfortunately, the AJAX call to getAuthTimeout is hard coded to fire every 60 seconds. In other words, if you're looking for a config value, there isn't one – might be worth a feature request?

For a quickfix/hack, you can create a custom plugin and add the following to its init method:

craft()->templates->includeJs('(function () {
    Craft.AuthManager.checkInterval = 600; // Ten minutes
}());', true);

You can change the 600 to any number of seconds, of course.

If you want to kill the timeout check completely, you can do this instead of the above:

craft()->templates->includeJs('(function () {
    Craft.AuthManager.prototype.setCheckAuthTimeoutTimer = function () {};
}());', true);

Of course, both of these snippets are total hacks. Use with caution!

One important thing to note is that I don't think its possible to stop the first AJAX call to getAuthTimeout (which will fire after 60 seconds). The reason is that by the time the JavaScript hack inside the includeJs handler has fired, the Craft.AuthManager class has already been initialized and created the first timeout object. There's no reference to this timeout stored anywhere on the Craft object (that I've been able to find, at least), which makes it impossible to clear it, unfortunately.


An equivalent for this code fragment in Craft 3 would be:

        $view = Craft::$app->getView();
        $js = /** @lang JavaScript */
            <<< EOT
(function () {
    Craft.AuthManager.checkInterval = 600; // Ten minutes
        $view->registerJs($js, $view::POS_READY);

For reference:

     * Registers a JS code block.
     * @param string $js the JS code block to be registered
     * @param int $position the position at which the JS script tag should be inserted
     * in a page. The possible values are:
     * - [[POS_HEAD]]: in the head section
     * - [[POS_BEGIN]]: at the beginning of the body section
     * - [[POS_END]]: at the end of the body section
     * - [[POS_LOAD]]: enclosed within jQuery(window).load().
     *   Note that by using this position, the method will automatically register the jQuery js file.
     * - [[POS_READY]]: enclosed within jQuery(document).ready(). This is the default value.
     *   Note that by using this position, the method will automatically register the jQuery js file.
     * @param string $key the key that identifies the JS code block. If null, it will use
     * $js as the key. If two JS code blocks are registered with the same key, the latter
     * will overwrite the former.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.