Backport: Honour consoleproxy.session.timeout for noVNC console sessions by dheeraj12347 · Pull Request #13058 · apache/cloudstack

dheeraj12347 · 2026-04-22T18:49:34Z

Description

This PR backports the console proxy/noVNC timeout fix to the 4.20 branch.

It ensures that consoleproxy.session.timeout is honoured for noVNC console
sessions, so idle sessions are cleaned up correctly and do not linger
indefinitely.

Key points:

Wire consoleproxy.session.timeout through the console proxy server for
noVNC-based console sessions.
Apply the timeout in the WebSocket handler and GC thread so idle sessions
are closed after the configured period.
Keep the change minimal and compatible with 4.20: do not introduce the
newer sessionRequiresNewViewer API on ConsoleProxyClientParam, only
remove the references that exist in later branches.

Related work

Backport of the console proxy timeout fix from the main branch.
Intended to address the same behaviour as the upstream change that fixed
idle noVNC sessions not respecting consoleproxy.session.timeout.

Testing

Compiled the console proxy server module successfully:

mvn -pl services/console-proxy/server -am -DskipTests compile

Verified that the code builds cleanly with checkstyle on the 4.20 branch.
Fix Global setting "consoleproxy.session.timeout " is not honoured #12810

Copilot

Pull request overview

This PR aims to backport the fix to ensure consoleproxy.session.timeout is honored for noVNC console sessions on the 4.20 branch, so idle sessions are cleaned up and don’t linger indefinitely.

Changes:

Updates the noVNC WebSocket handler with additional logging, parameter validation, and safer frame/error handling.
Refactors the console proxy GC thread loop and related logging around idle session cleanup.
Adjusts console proxy startup/authentication reflection and noVNC viewer creation/replacement logic.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
services/console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyNoVNCHandler.java	WebSocket connect/frame/error handling changes intended to support correct idle-session cleanup.
services/console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyGCThread.java	GC loop refactor and idle session timeout constant/comment updates.
services/console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxy.java	Console proxy startup/auth reflection changes and noVNC viewer lifecycle adjustments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

codecov · 2026-04-28T15:02:46Z

Codecov Report

❌ Patch coverage is 4.13223% with 116 lines in your changes missing coverage. Please review.
✅ Project coverage is 16.43%. Comparing base (549daae) to head (54364d6).
⚠️ Report is 53 commits behind head on 4.20.

Files with missing lines	Patch %	Lines
...main/java/com/cloud/consoleproxy/ConsoleProxy.java	2.94%	66 Missing ⚠️
...m/cloud/consoleproxy/ConsoleProxyNoVNCHandler.java	0.00%	30 Missing ⚠️
...a/com/cloud/consoleproxy/ConsoleProxyGCThread.java	0.00%	16 Missing ⚠️
...om/cloud/consoleproxy/ConsoleProxyNoVncClient.java	50.00%	2 Missing and 1 partial ⚠️
...om/cloud/consoleproxy/ConsoleProxyManagerImpl.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               4.20   #13058      +/-   ##
============================================
+ Coverage     16.26%   16.43%   +0.16%     
- Complexity    13434    13679     +245     
============================================
  Files          5667     5669       +2     
  Lines        500731   501678     +947     
  Branches      60803    60956     +153     
============================================
+ Hits          81455    82445     +990     
+ Misses       410172   409995     -177     
- Partials       9104     9238     +134

Flag	Coverage Δ
uitests	`4.16% <ø> (+0.01%)`	⬆️
unittests	`17.29% <4.13%> (+0.17%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

dheeraj12347 · 2026-04-29T22:34:47Z

Thanks for the detailed review and suggestions from Copilot.
I’ve read and understood all of the comments, especially around the 4.20 authenticateConsoleAccess signature/invocation, idle timeout handling in the GC thread, noVNC viewer activity tracking, and the unused sessionRequiresNewViewer flag.
I’ll work through each point and push updates to address them as soon as possible.

DaanHoogland · 2026-05-06T15:35:19Z

@dheeraj12347 , I set consoleproxy.session.timeout to 30000, expecting my consoles to get lost in half a minute. I restarted the MS. The consoles keep working until about the half an hour, the default setting. (I didn’t measure exactly) Can you have another look at this?

weizhouapache · 2026-05-07T14:20:55Z

@dheeraj12347
only one of #13002 and #13058 is needed.

once this is merged into 4.20, it will be included in main as well after forward-merge

dheeraj12347 · 2026-05-09T11:10:47Z

@dheeraj12347 , I set consoleproxy.session.timeout to 30000, expecting my consoles to get lost in half a minute. I restarted the MS. The consoles keep working until about the half an hour, the default setting. (I didn’t measure exactly) Can you have another look at this?

Hi @DaanHoogland ,

I’ve updated the PR to address the consoleproxy.session.timeout behaviour you described:

In ConsoleProxy.java I now read consoleproxy.session.timeout from the configuration (milliseconds), validate it, and store the effective value in ConsoleProxy.sessionTimeoutMillis, with a log line on startup showing the effective timeout.

In ConsoleProxyGCThread.java I removed the hardcoded idle timeout and changed the GC logic to compute each viewer’s idle time in milliseconds and compare it against ConsoleProxy.sessionTimeoutMillis, logging the idle duration and configured timeout when a session is removed.

To verify my changes, I built the console proxy server module with:

bash
mvn -pl services/console-proxy/server -am clean compile

I’m open to any feedback on this approach, and I’m happy to further adjust or iterate based on your results when you re-test with consoleproxy.session.timeout=30000.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

Damans227 · 2026-10-13T12:21:50Z

+            return;
+        }
        logger.trace("Sending client [ID: {}] frame of {} bytes.", viewer.getClientId(), f.getPayloadLength());
+        viewer.updateFrontEndActivityTime();


does an open console that nobody touches ever time out? the browser keeps asking for screen updates on its own, so every frame here looks like activity

Damans227 · 2026-10-16T18:27:25Z

does an open console that nobody touches ever time out?

@dheeraj12347 still no. every frame from the browser still counts as activity, and so does every screen update sent back to it. can we count only key presses and mouse moves?

dheeraj12347 · 2026-10-16T18:28:47Z

@DaanHoogland , @Pearl1594 and @Damans227
I found that the noVNC worker loop was refreshing the frontend activity timestamp repeatedly while the WebSocket connection remained open, even without user interaction. I've removed that refresh in commit ce7f38a.

I also checked the bundled noVNC implementation: continuous screen updates are enabled through a client message, while the resulting screen updates travel from the server to the browser. I'll verify the idle-session behavior and whether the activity refresh in onFrame() needs any further adjustment.

DaanHoogland · 2026-10-20T09:39:16Z

@blueorangutan package

blueorangutan · 2026-10-20T09:40:05Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-10-20T11:19:45Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19625

DaanHoogland · 2026-10-21T13:58:50Z

@blueorangutan test keepEnv

blueorangutan · 2026-10-21T14:00:05Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

dheeraj12347 · 2026-10-21T17:49:21Z

Hi @DaanHoogland, @Damans227, and @kiranchavala,

I've pushed an additional test in ConsoleProxyNoVncClientTest to verify that the frontend activity timestamp advances when updated.

The targeted test passes locally (2 tests, 0 failures), and the console-proxy server module compiles successfully.

The activity-tracking changes are also pushed. I'll continue verifying that only actual keyboard and mouse interactions refresh the idle timer, while automatic screen updates do not.

Could you please review the latest changes when convenient? Thanks!

blueorangutan · 2026-10-22T06:51:09Z

[SF] Trillian test result (tid-17181)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 56528 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13058-t17181-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

nvazquez · 2026-10-22T11:39:57Z

Thanks for the fix @dheeraj12347, can you please reference the PR from which the fix is being backported from?

Damans227 · 2026-10-22T11:54:11Z

@dheeraj12347 0f26cc3 covers my thread, only key presses and mouse moves keep the session alive now. when the timer runs out, does the console just freeze until the second timeout closes it? looks like an idle tab can sit frozen for up to 5 more minutes before it disconnects

DaanHoogland · 2026-10-23T09:09:34Z

@Damans227, @kiranchavala did you test this?

Damans227 · 2026-10-23T14:40:50Z

@DaanHoogland no, i havent run it on a lab, only read the code. still waiting on @dheeraj12347 for the frozen screen question above

kiranchavala

LGTM Tested manually


(localcloud) 🐱 > list configurations name=consoleproxy.session.timeout
{
  "configuration": [
    {
      "category": "Console Proxy",
      "component": "AgentManager",
      "defaultvalue": "300000",
      "description": "Timeout(in milliseconds) that console proxy tries to maintain a viewer session before it times out the session for no activity",
      "displaytext": "Consoleproxy session timeout",
      "group": "System VMs",
      "isdynamic": false,
      "name": "consoleproxy.session.timeout",
      "subgroup": "ConsoleProxyVM",
      "type": "Number",
      "value": "300000"
    }
  ],
  "count": 1
}

root@v-1-VM:~# tr ' ' '\n' < /var/cache/cloud/cmdline | grep session.timeout
consoleproxy.session.timeout=300000


root@v-1-VM:~# grep -i "consoleproxy.session.timeout" /var/log/cloud.log
2026-10-29T07:47:14,069 INFO  [cloud.consoleproxy.ConsoleProxy] (Console-Proxy-Main:[]) Context property consoleproxy.session.timeout: 300000
2026-10-29T07:47:14,196 INFO  [cloud.consoleproxy.ConsoleProxy] (Console-Proxy-Main:[]) Property consoleproxy.session.timeout: 300000
2026-10-29T07:47:14,336 INFO  [cloud.consoleproxy.ConsoleProxy] (Console-Proxy-Main:[]) Effective consoleproxy.session.timeout=300000 ms

Take a console seession of a vm

After 5 min


root@v-1-VM:~# tail -f /var/log/cloud.log | grep -Ei "Dropping|session.timeout|idle timeout|Viewer has been created"
2026-10-29T09:55:01,383 INFO  [cloud.consoleproxy.ConsoleProxyGCThread] (Console Proxy GC Thread:[]) Dropping com.cloud.consoleproxy.ConsoleProxyNoVncClient@30193f45 which has not been used for 304634 ms (configured timeout: 300000 ms)


[root@ref-trl-12549-k-Mol8-kiran-chavala-mgmt1 ~]# cmk update configuration name=consoleproxy.session.timeout value=60000
Loaded in-built API cache. Failed to read API cache, please run 'sync'.
{
  "configuration": {
    "category": "Console Proxy",
    "component": "AgentManager",
    "defaultvalue": "300000",
    "description": "Timeout(in milliseconds) that console proxy tries to maintain a viewer session before it times out the session for no activity",
    "displaytext": "Consoleproxy session timeout",
    "group": "System VMs",
    "isdynamic": false,
    "name": "consoleproxy.session.timeout",
    "subgroup": "ConsoleProxyVM",
    "type": "Number",
    "value": "60000"
  }
}

systemctl restart cloudstack-management

Only when the console proxy is Destoryed or stop/started the setting is updated in the console proxy

[root@ref-trl-12549-k-Mol8-kiran-chavala-mgmt1 ~]# cmk destroy systemvm id=d03bc871-63c1-4673-975f-940799d792e6

root@v-5-VM:~# tr ' ' '\n' < /var/cache/cloud/cmdline | grep session.timeout
consoleproxy.session.timeout=60000
root@v-5-VM:~# grep -i "consoleproxy.session.timeout" /var/log/cloud.log
2026-10-29T10:09:47,029 INFO  [cloud.consoleproxy.ConsoleProxy] (Console-Proxy-Main:[]) Context property consoleproxy.session.timeout: 60000
2026-10-29T10:09:47,138 INFO  [cloud.consoleproxy.ConsoleProxy] (Console-Proxy-Main:[]) Property consoleproxy.session.timeout: 60000
2026-10-29T10:09:47,207 INFO  [cloud.consoleproxy.ConsoleProxy] (Console-Proxy-Main:[]) Effective consoleproxy.session.timeout=60000 ms

Damans227 · 2026-10-29T10:55:10Z

@dheeraj12347 @DaanHoogland kiran tested this and the console froze when the timer ran out instead of closing. the log shows the session was dropped at 72s with a 70s timeout, but the tab stayed open and stuck. can we close the browser side too when the session is dropped, so the user sees it disconnected?

kiranchavala · 2026-10-29T10:58:10Z

@dheeraj12347 @DaanHoogland kiran tested this and the console froze when the timer ran out instead of closing. the log shows the session was dropped at 72s with a 70s timeout, but the tab stayed open and stuck. can we close the browser side too when the session is dropped, so the user sees it disconnected?

dheeraj12347 · 2026-10-29T16:12:15Z

Hi @DaanHoogland, @weizhouapache and @kiranchavala
I've updated ConsoleProxyNoVncClient.closeClient() to disconnect the frontend WebSocket when the idle session is dropped, and added a unit test to verify the disconnect call.

The targeted test passes locally (3 tests, 0 failures), and Checkstyle reports no violations.

Could you please verify that the browser-side console now disconnects correctly when the configured session timeout expires?

Damans227 · 2026-10-29T17:25:34Z

Could you please verify that the browser-side console now disconnects correctly when the configured session timeout expires?

@dheeraj12347 54364d6 covers it, the browser side is closed now when the idle session is dropped.

kiranchavala · 2026-10-30T04:08:09Z

@blueorangutan package

blueorangutan · 2026-10-30T04:10:05Z

@kiranchavala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-10-30T05:14:23Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19848

kiranchavala · 2026-10-30T05:44:08Z

root@v-1-VM:~# tail -f /var/log/cloud.log | grep -Ei "Dropping|session.timeout|idle timeout|Viewer has been created"

Thanks @dheeraj12347 issue is resolved, i see the console closed in the browser

root@v-6-VM:~# tail -f /var/log/cloud.log | grep -Ei "Dropping|session.timeout|idle timeout|Viewer has been created"
2026-10-30T05:33:16,187 INFO  [cloud.consoleproxy.ConsoleProxy] (Console-Proxy-Main:[]) Context property consoleproxy.session.timeout: 40000
2026-10-30T05:33:16,246 INFO  [cloud.consoleproxy.ConsoleProxy] (Console-Proxy-Main:[]) Property consoleproxy.session.timeout: 40000
2026-10-30T05:33:16,293 INFO  [cloud.consoleproxy.ConsoleProxy] (Console-Proxy-Main:[]) Effective consoleproxy.session.timeout=40000 ms
2026-10-30T05:33:33,869 INFO  [cloud.consoleproxy.ConsoleProxyNoVNCHandler] (qtp2110098569-41:[]) Viewer has been created successfully [session UUID: bab49d56-23fd-4663-af1d-706da9bab932, client IP: 10.0.3.251].
2026-10-30T05:34:21,667 INFO  [cloud.consoleproxy.ConsoleProxyGCThread] (Console Proxy GC Thread:[]) Dropping com.cloud.consoleproxy.ConsoleProxyNoVncClient@4a2403fc which has not been used for 42038 ms (configured timeout: 40000 ms)
2026-10-30T05:37:32,275 INFO  [cloud.consoleproxy.ConsoleProxyNoVNCHandler] (qtp2110098569-41:[]) Viewer has been created successfully [session UUID: b6040a9a-6d18-49d1-85c1-6859055e5f99, client IP: 10.0.3.251].
2026-10-30T05:38:16,766 INFO  [cloud.consoleproxy.ConsoleProxyGCThread] (Console Proxy GC Thread:[]) Dropping com.cloud.consoleproxy.ConsoleProxyNoVncClient@7465f4ce which has not been used for 40174 ms (configured timeout: 40000 ms)

DaanHoogland · 2026-10-30T10:14:09Z

@Damans227 @kiranchavala , you both approved, right? (i.e. this is ready-for-merge)

Damans227

@DaanHoogland yes, ready from my side. thanks @dheeraj12347. kirans retest on the last commit shows the console closing. LGTM.

boring-cyborg Bot added the component:console-proxy label Apr 22, 2026

DaanHoogland requested a review from Copilot April 28, 2026 09:54

DaanHoogland linked an issue Apr 28, 2026 that may be closed by this pull request

Global setting "consoleproxy.session.timeout " is not honoured #12810

Open

Copilot started reviewing on behalf of DaanHoogland April 28, 2026 09:56

View session

Copilot AI reviewed Apr 28, 2026

View reviewed changes

DaanHoogland modified the milestones: 4.22.2, 4.20.4 May 13, 2026

DaanHoogland added this to Apache CloudStack BugFest - Issues May 13, 2026

DaanHoogland removed this from Apache CloudStack BugFest - Issues May 13, 2026

DaanHoogland requested a review from Copilot May 21, 2026 14:38

Copilot started reviewing on behalf of DaanHoogland May 21, 2026 14:38

View session

This comment was marked as low quality.

Sign in to view

DaanHoogland requested a review from Copilot May 26, 2026 09:55

Copilot started reviewing on behalf of DaanHoogland May 26, 2026 09:55

View session

This comment was marked as low quality.

Sign in to view

DaanHoogland requested a review from Copilot May 27, 2026 08:21

Copilot started reviewing on behalf of DaanHoogland May 27, 2026 08:21

View session

Copilot AI reviewed May 27, 2026

View reviewed changes

apache deleted a comment from blueorangutan May 27, 2026

Damans227 reviewed Oct 13, 2026

View reviewed changes

Fix idle timeout tracking for noVNC sessions

ce7f38a

Fix noVNC console session activity tracking

0f26cc3

Add test for noVNC activity timestamp

c05ee03

kiranchavala approved these changes Oct 29, 2026

View reviewed changes

kiranchavala added the status:ready-for-merge label Oct 29, 2026

Close noVNC WebSocket when console session times out

54364d6

Damans227 approved these changes Oct 30, 2026

View reviewed changes

Conversation

dheeraj12347 commented Apr 22, 2026

Description

Related work

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

dheeraj12347 commented Apr 29, 2026

Uh oh!

DaanHoogland commented May 6, 2026

Uh oh!

weizhouapache commented May 7, 2026

Uh oh!

dheeraj12347 commented May 9, 2026

Uh oh!

This comment was marked as low quality.

Uh oh!

This comment was marked as low quality.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Damans227 Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

Damans227 commented Oct 16, 2026

Uh oh!

dheeraj12347 commented Oct 16, 2026

Uh oh!

DaanHoogland commented Oct 20, 2026

Uh oh!

blueorangutan commented Oct 20, 2026

Uh oh!

blueorangutan commented Oct 20, 2026

Uh oh!

DaanHoogland commented Oct 21, 2026

Uh oh!

blueorangutan commented Oct 21, 2026

Uh oh!

dheeraj12347 commented Oct 21, 2026

Uh oh!

blueorangutan commented Oct 22, 2026

Uh oh!

nvazquez commented Oct 22, 2026

Uh oh!

Damans227 commented Oct 22, 2026

Uh oh!

DaanHoogland commented Oct 23, 2026

Uh oh!

Damans227 commented Oct 23, 2026

Uh oh!

kiranchavala left a comment

Choose a reason for hiding this comment

Uh oh!

Damans227 commented Oct 29, 2026

Uh oh!

kiranchavala commented Oct 29, 2026

Uh oh!

dheeraj12347 commented Oct 29, 2026

Uh oh!

Damans227 commented Oct 29, 2026

Uh oh!

codecov Bot commented Apr 28, 2026 •

edited

Loading