Backport: Honour consoleproxy.session.timeout for noVNC console sessions by dheeraj12347 · Pull Request #13058 · apache/cloudstack

dheeraj12347 · 2026-04-22T18:49:34Z

Description

This PR backports the console proxy/noVNC timeout fix to the 4.20 branch.

It ensures that consoleproxy.session.timeout is honoured for noVNC console
sessions, so idle sessions are cleaned up correctly and do not linger
indefinitely.

Key points:

Wire consoleproxy.session.timeout through the console proxy server for
noVNC-based console sessions.
Apply the timeout in the WebSocket handler and GC thread so idle sessions
are closed after the configured period.
Keep the change minimal and compatible with 4.20: do not introduce the
newer sessionRequiresNewViewer API on ConsoleProxyClientParam, only
remove the references that exist in later branches.

Related work

Backport of the console proxy timeout fix from the main branch.
Intended to address the same behaviour as the upstream change that fixed
idle noVNC sessions not respecting consoleproxy.session.timeout.

Testing

Compiled the console proxy server module successfully:

mvn -pl services/console-proxy/server -am -DskipTests compile

Verified that the code builds cleanly with checkstyle on the 4.20 branch.
Fix Global setting "consoleproxy.session.timeout " is not honoured #12810

Copilot

Pull request overview

This PR aims to backport the fix to ensure consoleproxy.session.timeout is honored for noVNC console sessions on the 4.20 branch, so idle sessions are cleaned up and don’t linger indefinitely.

Changes:

Updates the noVNC WebSocket handler with additional logging, parameter validation, and safer frame/error handling.
Refactors the console proxy GC thread loop and related logging around idle session cleanup.
Adjusts console proxy startup/authentication reflection and noVNC viewer creation/replacement logic.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
services/console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyNoVNCHandler.java	WebSocket connect/frame/error handling changes intended to support correct idle-session cleanup.
services/console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyGCThread.java	GC loop refactor and idle session timeout constant/comment updates.
services/console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxy.java	Console proxy startup/auth reflection changes and noVNC viewer lifecycle adjustments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

codecov · 2026-04-28T15:02:46Z

Codecov Report

❌ Patch coverage is 1.73913% with 113 lines in your changes missing coverage. Please review.
✅ Project coverage is 16.43%. Comparing base (549daae) to head (c05ee03).
⚠️ Report is 52 commits behind head on 4.20.

Files with missing lines	Patch %	Lines
...main/java/com/cloud/consoleproxy/ConsoleProxy.java	2.94%	66 Missing ⚠️
...m/cloud/consoleproxy/ConsoleProxyNoVNCHandler.java	0.00%	30 Missing ⚠️
...a/com/cloud/consoleproxy/ConsoleProxyGCThread.java	0.00%	16 Missing ⚠️
...om/cloud/consoleproxy/ConsoleProxyManagerImpl.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               4.20   #13058      +/-   ##
============================================
+ Coverage     16.26%   16.43%   +0.16%     
- Complexity    13434    13671     +237     
============================================
  Files          5667     5669       +2     
  Lines        500731   501655     +924     
  Branches      60803    60953     +150     
============================================
+ Hits          81455    82423     +968     
+ Misses       410172   409998     -174     
- Partials       9104     9234     +130

Flag	Coverage Δ
uitests	`4.16% <ø> (+0.01%)`	⬆️
unittests	`17.29% <1.73%> (+0.17%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

dheeraj12347 · 2026-04-29T22:34:47Z

Thanks for the detailed review and suggestions from Copilot.
I’ve read and understood all of the comments, especially around the 4.20 authenticateConsoleAccess signature/invocation, idle timeout handling in the GC thread, noVNC viewer activity tracking, and the unused sessionRequiresNewViewer flag.
I’ll work through each point and push updates to address them as soon as possible.

DaanHoogland · 2026-05-06T15:35:19Z

@dheeraj12347 , I set consoleproxy.session.timeout to 30000, expecting my consoles to get lost in half a minute. I restarted the MS. The consoles keep working until about the half an hour, the default setting. (I didn’t measure exactly) Can you have another look at this?

weizhouapache · 2026-05-07T14:20:55Z

@dheeraj12347
only one of #13002 and #13058 is needed.

once this is merged into 4.20, it will be included in main as well after forward-merge

dheeraj12347 · 2026-05-09T11:10:47Z

@dheeraj12347 , I set consoleproxy.session.timeout to 30000, expecting my consoles to get lost in half a minute. I restarted the MS. The consoles keep working until about the half an hour, the default setting. (I didn’t measure exactly) Can you have another look at this?

Hi @DaanHoogland ,

I’ve updated the PR to address the consoleproxy.session.timeout behaviour you described:

In ConsoleProxy.java I now read consoleproxy.session.timeout from the configuration (milliseconds), validate it, and store the effective value in ConsoleProxy.sessionTimeoutMillis, with a log line on startup showing the effective timeout.

In ConsoleProxyGCThread.java I removed the hardcoded idle timeout and changed the GC logic to compute each viewer’s idle time in milliseconds and compare it against ConsoleProxy.sessionTimeoutMillis, logging the idle duration and configured timeout when a session is removed.

To verify my changes, I built the console proxy server module with:

bash
mvn -pl services/console-proxy/server -am clean compile

I’m open to any feedback on this approach, and I’m happy to further adjust or iterate based on your results when you re-test with consoleproxy.session.timeout=30000.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

DaanHoogland · 2026-09-30T12:41:19Z

@dheeraj12347 : a ai generated comment to this change:

Heads up: this fix won't actually take effect even once merged.

I traced why a changed consoleproxy.session.timeout still logs 300000 ms after recreating the CPVM (as seen in the thread above (#)): the ConfigKey ConsoleProxySessionTimeout (server/.../ConsoleProxyManager.java:81) is never forwarded to the CPVM. The only place that reads it management-server-side is the unrelated hasPreviousSession() reassignment check — ConsoleProxyManagerImpl.finalizeVirtualMachineProfile(), which builds the CPVM's boot args, forwards ConsoleProxySessionReconnectionWindow (session_reconnection_window=...) but has no equivalent line for this setting. So conf.getProperty("consoleproxy.session.timeout") on the CPVM side always returns null, and sessionTimeoutMillis stays at its Java default of 300000 regardless of what's configured.

This PR needs an additional hunk in ConsoleProxyManagerImpl.java, next to the sessionReconnectionWindow block:

Integer sessionTimeoutMillis = ConsoleProxySessionTimeout.valueIn(datacenterId);
if (sessionTimeoutMillis != null && sessionTimeoutMillis > 0) {
buf.append(" consoleproxy.session.timeout=").append(sessionTimeoutMillis);
}

Without it, the WebSocket-idle-timeout and GC-thread changes in this PR are unreachable — the config setting will keep behaving exactly as it does today.

I think we (as in you ;) ) should add this to this PR.

dheeraj12347 · 2026-10-03T08:19:19Z

Thanks @DaanHoogland, I added the missing propagation of consoleproxy.session.timeout to the CPVM boot arguments in ConsoleProxyManagerImpl, as suggested.
In the 4.20 branch, I used the existing proxySessionTimeoutValue, which is already initialized from the consoleproxy.session.timeout configuration, to keep the backport minimal and compatible.
I also verified that the console-proxy module compiles successfully and git diff --check passes.

DaanHoogland · 2026-10-05T07:46:44Z

@blueorangutan package

blueorangutan · 2026-10-05T07:48:05Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-10-05T08:46:20Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19399

DaanHoogland · 2026-10-05T11:20:54Z

@blueorangutan test keepEnv

blueorangutan · 2026-10-05T11:22:05Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2026-10-06T05:16:10Z

[SF] Trillian test result (tid-17073)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 60429 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13058-t17073-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

DaanHoogland · 2026-10-06T14:32:27Z

@kiranchavala can you have a second look?

dheeraj12347 · 2026-10-10T16:25:05Z

Hi @DaanHoogland and @Pearl1594, I noticed that the Codecov, Simulator CI and UI Build checks are currently failing on this PR. The Codecov log shows repeated request failures while creating the commit record at ingest.codecov.io. Are these failures known infrastructure issues, or should I investigate any specific failures on my side? Thanks!

DaanHoogland · 2026-10-13T06:27:07Z

@dheeraj12347 leave the UI. codecov, I'm not sure of, but IU doubt it has anything to do with your code.

Damans227 · 2026-10-13T12:21:50Z

+            return;
+        }
        logger.trace("Sending client [ID: {}] frame of {} bytes.", viewer.getClientId(), f.getPayloadLength());
+        viewer.updateFrontEndActivityTime();


does an open console that nobody touches ever time out? the browser keeps asking for screen updates on its own, so every frame here looks like activity

Damans227 · 2026-10-16T18:27:25Z

does an open console that nobody touches ever time out?

@dheeraj12347 still no. every frame from the browser still counts as activity, and so does every screen update sent back to it. can we count only key presses and mouse moves?

dheeraj12347 · 2026-10-16T18:28:47Z

@DaanHoogland , @Pearl1594 and @Damans227
I found that the noVNC worker loop was refreshing the frontend activity timestamp repeatedly while the WebSocket connection remained open, even without user interaction. I've removed that refresh in commit ce7f38a.

I also checked the bundled noVNC implementation: continuous screen updates are enabled through a client message, while the resulting screen updates travel from the server to the browser. I'll verify the idle-session behavior and whether the activity refresh in onFrame() needs any further adjustment.

DaanHoogland · 2026-10-20T09:39:16Z

@blueorangutan package

blueorangutan · 2026-10-20T09:40:05Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-10-20T11:19:45Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19625

DaanHoogland · 2026-10-21T13:58:50Z

@blueorangutan test keepEnv

blueorangutan · 2026-10-21T14:00:05Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

dheeraj12347 · 2026-10-21T17:49:21Z

Hi @DaanHoogland, @Damans227, and @kiranchavala,

I've pushed an additional test in ConsoleProxyNoVncClientTest to verify that the frontend activity timestamp advances when updated.

The targeted test passes locally (2 tests, 0 failures), and the console-proxy server module compiles successfully.

The activity-tracking changes are also pushed. I'll continue verifying that only actual keyboard and mouse interactions refresh the idle timer, while automatic screen updates do not.

Could you please review the latest changes when convenient? Thanks!

blueorangutan · 2026-10-22T06:51:09Z

[SF] Trillian test result (tid-17181)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 56528 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13058-t17181-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

nvazquez · 2026-10-22T11:39:57Z

Thanks for the fix @dheeraj12347, can you please reference the PR from which the fix is being backported from?

Damans227 · 2026-10-22T11:54:11Z

@dheeraj12347 0f26cc3 covers my thread, only key presses and mouse moves keep the session alive now. when the timer runs out, does the console just freeze until the second timeout closes it? looks like an idle tab can sit frozen for up to 5 more minutes before it disconnects

DaanHoogland · 2026-10-23T09:09:34Z

@Damans227, @kiranchavala did you test this?

Damans227 · 2026-10-23T14:40:50Z

@DaanHoogland no, i havent run it on a lab, only read the code. still waiting on @dheeraj12347 for the frozen screen question above

boring-cyborg Bot added the component:console-proxy label Apr 22, 2026

DaanHoogland requested a review from Copilot April 28, 2026 09:54

DaanHoogland linked an issue Apr 28, 2026 that may be closed by this pull request

Global setting "consoleproxy.session.timeout " is not honoured #12810

Open

Copilot started reviewing on behalf of DaanHoogland April 28, 2026 09:56

View session

Copilot AI reviewed Apr 28, 2026

View reviewed changes

DaanHoogland modified the milestones: 4.22.2, 4.20.4 May 13, 2026

DaanHoogland added this to Apache CloudStack BugFest - Issues May 13, 2026

DaanHoogland removed this from Apache CloudStack BugFest - Issues May 13, 2026

DaanHoogland requested a review from Copilot May 21, 2026 14:38

Copilot started reviewing on behalf of DaanHoogland May 21, 2026 14:38

View session

This comment was marked as low quality.

Sign in to view

DaanHoogland requested a review from Copilot May 26, 2026 09:55

Copilot started reviewing on behalf of DaanHoogland May 26, 2026 09:55

View session

This comment was marked as low quality.

Sign in to view

DaanHoogland requested a review from Copilot May 27, 2026 08:21

Copilot started reviewing on behalf of DaanHoogland May 27, 2026 08:21

View session

Copilot AI reviewed May 27, 2026

View reviewed changes

apache deleted a comment from blueorangutan May 27, 2026

DaanHoogland mentioned this pull request Sep 30, 2026

noVNC console disconnects when Jetty WebSocket reaches idle timeout on CloudStack 4.22.1.1 #14097

Open

Forward console proxy session timeout to CPVM

d45b35a

Damans227 reviewed Oct 13, 2026

View reviewed changes

Fix idle timeout tracking for noVNC sessions

ce7f38a

Fix noVNC console session activity tracking

0f26cc3

Add test for noVNC activity timestamp

c05ee03

Conversation

dheeraj12347 commented Apr 22, 2026

Description

Related work

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

dheeraj12347 commented Apr 29, 2026

Uh oh!

DaanHoogland commented May 6, 2026

Uh oh!

weizhouapache commented May 7, 2026

Uh oh!

dheeraj12347 commented May 9, 2026

Uh oh!

This comment was marked as low quality.

Uh oh!

This comment was marked as low quality.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DaanHoogland commented Sep 30, 2026

Uh oh!

dheeraj12347 commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DaanHoogland commented Oct 5, 2026

Uh oh!

blueorangutan commented Oct 5, 2026

Uh oh!

blueorangutan commented Oct 5, 2026

Uh oh!

DaanHoogland commented Oct 5, 2026

Uh oh!

blueorangutan commented Oct 5, 2026

Uh oh!

blueorangutan commented Oct 6, 2026

Uh oh!

DaanHoogland commented Oct 6, 2026

Uh oh!

dheeraj12347 commented Oct 10, 2026

Uh oh!

DaanHoogland commented Oct 13, 2026

Uh oh!

Damans227 Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

Damans227 commented Oct 16, 2026

Uh oh!

dheeraj12347 commented Oct 16, 2026

Uh oh!

DaanHoogland commented Oct 20, 2026

Uh oh!

blueorangutan commented Oct 20, 2026

Uh oh!

blueorangutan commented Oct 20, 2026

Uh oh!

DaanHoogland commented Oct 21, 2026

Uh oh!

blueorangutan commented Oct 21, 2026

Uh oh!

codecov Bot commented Apr 28, 2026 •

edited

Loading

dheeraj12347 commented Oct 3, 2026 •

edited

Loading