zmNinja authentication loop

[superdipak]

I am running zoneminder 1.36.33 on debian 12 bookworm and am using builtin authentication. Everything works fine on a web browser but when I log in on a zmNinja (pro) app, I can see a very fast, continuously looping message "zoneminder authentication success" at the top of the app screen. This is seriously slowing down the app to the point that is it almost unusable. I have tried various combinations of AUTH related options on the zoneminder server but nothing seems to work.

In the server apache2 logs, I can see multiple occurrences of the following (about 30 per sec). IP addresses, tokens etc have been redacted with xxxs:

XX.XX.XX.XX - - [24/May/2025:10:09:09 +0000] "GET /zm/api/configs/viewByName/ZM_AUTH_HASH_LOGINS.json?&token=xxxxxxxxxxxxxx HTTP/1.1" 200 869 "-" "Dalvik/2.1.0 (Linux; U; Android 14; samsung xx xx Build/U1TCS34.22-64-19-4-4)"

Can anyone suggest a solution to this annoying problem?

[iconnor]

zmninja-pro is never going to get another update. Please install the zmNinja app.

[superdipak]

zmNinja app had the same issue. However, I discovered this is caused by by a very high value of AUTH_HASH_TTL. I am not sure what the tipping point exactly is but when I reduced it from 720 (30 days) to 168 (7 days), the problem vanished.

[iconnor]

AUTH_HASH_TTL is in seconds....

[superdipak]

In which case, it looks like the documentation needs to be corrected. Please see the attached screenshot:

AUTH_HASH_TTL.png (10.02 KiB) Viewed 400 times

[iconnor]

You are right of course . Why have you felt the need to increase it from 2? I assume to stay logged in longer...

[superdipak]

That's correct. I can only get a session length of 7 days when I set COOKIE_LIFETIME to 604800 (number of secs) and AUTH_HASH_TTL to 168 (number of hours)