omv-rememberme

Persistent Remember Me authentication for the OpenMediaVault 8 Workbench.

Features

• Optional Remember me checkbox on the OpenMediaVault login page.
• Opaque selector/validator browser credentials.
• Validator secrets are stored server-side only as SHA-256 hashes.
• HttpOnly, Secure, SameSite=Lax, host-only browser cookie.
• Browser credential rotation on remembered resume.
• Fixed absolute Remember Me lifetime.
• Refreshing or automatically resuming does not extend expiration.
• Successful manual authentication can start a fresh Remember Me lifetime.
• Warning one minute before Remember Me expiration.
• Authenticated users can explicitly extend the Remember Me lifetime.
• OpenMediaVault automatic inactivity logout preserves Remember Me.
• Explicit logout revokes the browser credential.
• Forget this browser immediately revokes the browser credential.
• Remember Me checkbox preference survives normal credential expiration.
• Login-page state automatically synchronizes with token validity.
• Native OpenMediaVault configuration page under System -> Remember Me.
• Uses OpenMediaVault's native Automatic timeout setting.
• Remember Me lifetime is configured in minutes.
• Reverse-proxy friendly; no backend hostname or address is hard-coded.
• Audit logging through the openmediavault-rememberme syslog identifier.

Compatibility

Designed for:

• OpenMediaVault 8.5+
• Debian 13 / Trixie

Tested platforms

Architecture	Platform	Status
amd64 / x86_64	OpenMediaVault 8 on Debian 13	✅ Tested
arm64 / aarch64	OpenMediaVault 8 on Debian 13	🧪 Testing requested
armhf / ARMv7	OpenMediaVault 8 where supported	🧪 Testing requested

The Debian package is built as Architecture: all and contains no compiled architecture-specific binaries.

ARM platforms are expected to be compatible, but they will remain listed as unverified until tested on real OpenMediaVault systems.

If you test successfully on ARM, please open a GitHub issue with the hardware model, architecture, OpenMediaVault version, and Debian version.

Configuration

Open:

System -> Remember Me

Automatic timeout

This is the same setting exposed by:

System -> Workbench -> Settings -> Automatic timeout

The value is in minutes.

0 disables automatic Workbench logout.

Remember Me lifetime

The persistent browser credential lifetime is specified in minutes.

The lifetime is absolute from the time the credential is issued.

For example:

• 60 = 1 hour
• 480 = 8 hours
• 1440 = 1 day
• 10080 = 7 days
• 86400 = 60 days

A remembered F5/resume rotates the credential but does not extend its expiration.

A successful manual credential login with Remember Me selected starts a new full lifetime.

The expiration warning also allows an authenticated user to explicitly start a new full lifetime.

Installation

Install the release package:

apt install ./openmediavault-rememberme_8.1.0_all.deb

Then hard-refresh the OpenMediaVault Workbench in the browser.

Removing the plugin

apt remove openmediavault-rememberme

Removing the package invalidates remembered browser credentials.

To also remove persistent plugin configuration:

apt purge openmediavault-rememberme

Building

From the repository root:

./scripts/build-deb.sh

The resulting package is written to:

dist/openmediavault-rememberme_<version>_all.deb

Contributing

Contributions, testing, bug reports, and feature requests are welcome.

See CONTRIBUTING.md for development guidelines, authentication behavior that should be preserved, build instructions, and ARM testing information.

ARM testers are especially welcome for arm64 and armhf platforms.

Issues

Bug reports and feature requests should be submitted using the GitHub repository's Issues page.

Please include:

• OpenMediaVault version
• Debian version
• architecture
• browser and version
• whether a reverse proxy is in use
• relevant openmediavault-rememberme journal messages

Security

Do not publish exploit details or sensitive security information in a public GitHub Issue.

Use GitHub private vulnerability reporting for security-sensitive reports.

License

MIT License

Copyright (c) 2026 Greg Elsbernd