Every logged-in Odoo user who walks away from a warehouse terminal, a shared POS workstation, or an unlocked laptop is a standing security exposure. Odoo core keeps a session alive on a long-lived session_id cookie and, by default, does not force-close a session purely because the user stopped interacting — the standard session-timeout setting behaves more like an absolute cookie lifetime than a true idle timer. For teams under SOC 2, ISO 27001, HIPAA, GDPR, or internal-audit pressure, "the screen just stays logged in" is a finding waiting to happen, and native controls run out of road exactly where auditors look hardest: no per-group idle policy, no distinction between an accountant's browser and a public-facing kiosk, no forced re-authentication, and no record of why a session ended.

Inactive Sessions Timeout is a made-to-order Odoo module we build to close that gap. At its core it tracks last-activity time per session and expires sessions that exceed a configurable idle delay, independent of the absolute cookie lifetime. We implement a lightweight activity heartbeat in OWL/JS on the web client that stamps a server-side last_activity value against a session-tracking model (an ORM models.Model with proper ir.model.access.csv entries and record rules), plus an overridden authentication/dispatch layer that checks elapsed idle time on each request and cleanly invalidates the session — redirecting to the login screen — once the threshold is crossed. Idle delays are data-driven configuration: a global default on res.config.settings, with optional overrides per res.groups so that, for example, finance users time out after 5 minutes while back-office planners get 30. A scheduled action (ir.cron) sweeps and garbage-collects stale server-side session records so the store never bloats.

Because it is built rather than bought off a shelf, we scope it to your real threat model. Common extensions we implement include a client-side "you will be logged out in N seconds" warning dialog with a keep-alive button, exemptions for long-running background tabs or specific automated integrations, tighter rules for POS and public kiosks, separate handling for the JSON-RPC/XML-RPC API surface (which uses API keys or session auth differently from the interactive web client), and an audit log capturing session start, last activity, and reason-for-termination for your evidence pack. Everything is delivered as a clean, installable module with a versioned __manifest__.py, respecting Community vs Enterprise differences and tested against your target Odoo 17.0, 18.0, or 19.0.

Delivery is build-to-order: it starts with a short scoping call to confirm your idle-delay policy matrix, which user groups and access contexts are in play, and any compliance evidence you need. We then build on a staging copy of your database, run UAT with you, and deploy to production with a rollback plan and a git repository handover. Typical delivery is 2–4 weeks from confirmed scope. Pricing starts from $249 (indicative, single-company base scope); multi-company idle policies, POS/kiosk hardening, API-surface handling, and deeper audit-logging or SIEM integration increase the quoted scope.