Vernok.SessionGuard provides session warnings and renewal for October CMS — backend editors, RainLab.User members, and visitors filling in forms.
Before a session expires, users see a clear dialog with a live countdown. They can extend the session without a full page reload, or sign out safely. Visitor forms stay recoverable when someone is mid-edit near CSRF expiry. Dialogs, copy, and behaviour ship with the plugin: no custom UI work required.
Built for real October CMS projects
Session expiry is one of the most frustrating experiences in CMS work: unsaved backend edits, lost form input, and sudden redirects to a login screen.
SessionGuard solves this with finished dialogs and sensible defaults. Install the plugin, assign the settings permission, and editors get session warnings on the next authenticated backend load. Frontend and RainLab integration follow the same pattern when those surfaces are in use.
Agencies do not need to design session UI, wire countdown logic, or maintain translations per project.
Features
- Ready-made warning, extend, and sign-out dialogs for backend and frontend
- Live countdown before session expiry
- Extend session without a full page reload
- Unsaved-work emphasis when editors have pending changes
- October backend integration using native popup styling (light/dark chrome)
- RainLab.User integration when installed — including hydration after AJAX login
- Visitor form protection for dirty forms near CSRF expiry
- CSRF token refresh after session renewal
- Cross-tab sign-out awareness
- Offline and error states with clear retry behaviour
- Five languages included: English, Dutch, German, French, Spanish
- Frontend dialog appearance: System UI, Light, or Dark
- Backend settings UI with General and RainLab.User tabs
- Environment and config overrides for stricter policies when needed
- Optional auto-extend on activity, single-session enforcement, and expire-on-close policy
- October CMS 4 and PHP 8.3 support
Ready-made dialogs
SessionGuard includes the full dialog experience — not just a timer.
| Experience | What users see |
|---|---|
| Warning | Friendly prompt with live countdown · Extend session · Sign out |
| Unsaved work | Extra emphasis when there are unsaved changes |
| Extending / success | Short feedback while renewing · toast when done |
| Expired | Clear end state · sign in (auth) or refresh page (forms) |
| Offline / error | Retry without guessing whether the session was extended |
| Visitor forms | Same pattern for dirty forms · renew keeps input and refreshes CSRF |
Backend uses October's native popup. Frontend uses SessionGuard's own dialog UI, with appearance that follows the site or device theme by default.
Three surfaces, one plugin
SessionGuard covers the places session loss actually hurts:
October backend — loads on authenticated full page loads. Editors see warnings, can extend, or sign out.
RainLab.User — when RainLab is installed and integration is enabled, signed-in website users get the same extend / sign-out flow. SessionGuard hydrates correctly after AJAX login.
Visitor forms — with form protection enabled (default), guests editing a form see a warning before CSRF expiry. Extending renews the session and updates CSRF tokens automatically. Individual forms can opt out with data-vernok-session-guard-ignore.
Languages included
All dialog strings ship in English, Dutch, German, French, and Spanish. October's active locale selects the copy. No translation files are required for a default install.
Sensible defaults, flexible policy
SessionGuard starts conservative: warnings on, auto-extend off, form protection on. Stricter policies — expire on browser close, one session per user, RainLab-specific overrides — are available in Settings → Back-end → Session warnings or through environment variables.
Login URL overrides remain config-only for security. Settings, config, and built-in defaults follow a clear precedence order.
Requirements
SessionGuard depends on Vernok.Vite for frontend assets. RainLab.User is optional but fully supported when present.
Installation via Command Line
php artisan plugin:install Vernok.SessionGuard
Installation via Command Line
php artisan plugin:install Vernok.SessionGuard
Vernok.SessionGuard
Session warnings and renewal for October CMS — ready to use after install.
Editors and website users get a clear dialog before the session ends, can extend without a full page reload, and visitor forms stay recoverable when someone is mid-edit near CSRF expiry. Dialogs, copy, and behaviour ship with the plugin: no custom UI work required.
Vernok.SessionGuard is proprietary commercial software. See LICENSE.md.
Contents
What you get
Ready-made dialogs
SessionGuard includes finished front-end and back-end dialogs — countdown, actions, and states — so agencies do not design or wire session UI per project.
| Experience | What users see |
|---|---|
| Warning | Friendly prompt (Are you still there?) with live countdown · Extend session · Sign out |
| Unsaved work | Extra emphasis when the editor has unsaved changes |
| Extending / success | Short feedback while renewing · toast when done |
| Expired | Clear end state · sign in (auth) or refresh page (forms / remember-restore) |
| Offline / error | Retry without guessing whether the session was extended |
| Visitor forms | Same pattern for dirty forms · renew keeps input and refreshes CSRF |
Backend uses October’s native popup (follows the backend light/dark chrome). Frontend (RainLab / guest forms) uses SessionGuard’s own dialog UI, with System UI / Light / Dark appearance (default System UI — follows the device or site theme).
Five languages included
All dialog strings ship in:
| Language | Locale |
|---|---|
| English | en |
| Dutch | nl |
| German | de |
| French | fr |
| Spanish | es |
October’s active locale picks the copy. No translation files or overrides are needed for a default install.
Surfaces covered
| Surface | Out of the box |
|---|---|
| October backend | Loads on authenticated full page loads · warning, extend, sign out |
| RainLab.User | Same when RainLab is installed and mode is Enabled · hydrates after AJAX login |
| Visitor forms | Protects dirty forms by default · opt out per form if needed |
Cross-tab behaviour is included (for example sign-out awareness). Defaults are conservative; stricter policy is available in Settings when a project needs it.
Installation
php artisan plugin:install Vernok.SessionGuard php artisan october:migrate
Assign Manage SessionGuard settings to roles that may change Settings.
Requirements
| Dependency | Constraint |
|---|---|
| PHP | ^8.3 |
| October CMS | ^4.0 |
| Vernok.Vite | Required |
| RainLab.User | Optional · v3.5+ recommended |
Defaults
| Setting | Value |
|---|---|
| Enabled | On |
| Warning time | 300 seconds (5 minutes) |
| End session when browser closes | Off |
| One session per user | Off |
| Auto-extend on activity | Off |
| Protect visitor forms | On |
| Dialog appearance | System UI (system) |
| RainLab.User mode | Enabled when RainLab is present |
| Accept remember-me as seamless extend | Off |
| Bearer / JWT | Off |
Configuration
Settings UI
Settings → Back-end → Session warnings
| Tab | Purpose |
|---|---|
| General | Backend defaults · also used by RainLab when a field is Default / empty |
| RainLab.User | Integration · login page · optional overrides that inherit from General |
Precedence
- Saved Settings (allowlisted keys)
config/sessionguard.php/SESSIONGUARD_*- Built-in defaults
Login URL overrides are env/config only — never from Settings.
Environment variables
General / backend
| Variable | Default | Description |
|---|---|---|
SESSIONGUARD_ENABLED |
true |
Global switch |
SESSIONGUARD_WARNING_BEFORE |
300 |
Seconds before expiry to show the warning |
SESSIONGUARD_EXPIRE_ON_CLOSE |
false |
End session when the browser closes |
SESSIONGUARD_FORCE_SINGLE_SESSION |
false |
One concurrent backend login |
SESSIONGUARD_BACKEND_AUTO_EXTEND |
false |
Auto-extend on recent activity |
SESSIONGUARD_GUEST_FORM_PROTECTION |
true |
Warn guests with dirty forms |
SESSIONGUARD_UI_APPEARANCE |
system |
Frontend dialog/toast: system · light · dark |
SESSIONGUARD_BACKEND_LOGIN_URL |
— | Same-origin / relative backend sign-in URL |
SESSIONGUARD_AUTO_EXTEND |
false |
Legacy alias for backend auto-extend |
RainLab.User
| Variable | Default | Description |
|---|---|---|
SESSIONGUARD_RAINLAB_MODE |
enabled |
enabled · disabled |
SESSIONGUARD_RAINLAB_GUARD |
web |
Laravel guard name |
SESSIONGUARD_RAINLAB_BEARER_TOKENS |
false |
Bearer / JWT off |
SESSIONGUARD_RAINLAB_LOGIN_URL |
— | Same-origin / relative login URL |
SESSIONGUARD_RAINLAB_LOGIN_PAGE |
auto |
CMS page file name or auto |
SESSIONGUARD_RAINLAB_WARNING_BEFORE |
— | Empty = use General |
SESSIONGUARD_RAINLAB_EXPIRE_ON_CLOSE |
inherit |
inherit · enabled · disabled |
SESSIONGUARD_RAINLAB_FORCE_SINGLE_SESSION |
inherit |
Syncs RainLab block_persistence |
SESSIONGUARD_RAINLAB_AUTO_EXTEND |
inherit |
Inherit = General auto-extend |
Renewal & activity
| Variable | Default | Description |
|---|---|---|
SESSIONGUARD_ACCEPT_REMEMBER_RESTORE |
false |
Remember-me restore is not a seamless extend |
SESSIONGUARD_MAX_LIFETIME_SECONDS |
12 × session.lifetime |
Hard cap on sliding renewals |
SESSIONGUARD_ACTIVITY_THROTTLE_MS |
1000 |
Activity throttle for auto-extend |
SESSIONGUARD_INTERACTION_EVENTS |
keydown,pointerdown,touchstart,input,change,scroll |
Events that count as activity |
SESSIONGUARD_DEBUG |
false |
Server-side debug |
Shared session
Backend and RainLab usually share october_session. Expire-on-close on either surface applies to that cookie.
Visitor-form Extend slides that shared cookie (and refreshes CSRF) even when you are also logged into the backend. If the cookie is already gone, only a full page refresh can start a new session.
Prefer SESSION_SAME_SITE=lax (or strict) in production.
Usage
Backend
SessionGuard loads on authenticated full page loads. Editors see the warning dialog with countdown, then Extend session or Sign out — no theme work.
RainLab.User
With RainLab.User installed and mode Enabled:
- Signed-in visitors get the same extend / sign-out flow on the website
- After AJAX login, SessionGuard moves from dormant / guest into auth mode
- Choose the login page under Settings → RainLab.User (automatic or a CMS page)
If remember-me restores a session after idle expiry, users see a refresh page dialog unless accept-remember-restore is enabled.
Visitor forms
With Protect visitor forms on (default):
- The dialog appears only when a
<form>was edited and the session is in the warning window - Extending renews the session and updates CSRF (
meta[name=csrf-token],input[name=_token])
Opt a form out:
<form data-vernok-session-guard-ignore>
…
</form>
-
This plugin has not been reviewed yet.
-
| 0.0.1 |
First version of SessionGuard. Aug 26, 2026 |
|---|