Question
Password Expiration Behavior in Dyalog APL Server: Does an Expired Credential Immediately Block Active Sessions?
Ari Finch
0 reputation · 11 Feb 2026, 09:29 UTC
40.3K views1
Loading…
0 reputation · 11 Feb 2026, 09:29 UTC
In Dyalog APL Server (DAS) 22.12, administrators can enforce password expiration via the PasswordPolicy section of server.cfg. The documentation states that expired passwords prevent new logins, but it does not specify what happens to sessions that are already established when the expiry date passes. This ambiguity is critical for least‑privilege security models, where an account should not retain access after its credential has expired.
Because DAS currently lacks a documented automatic revocation mechanism for active sessions tied to expired credentials, it is unclear whether a user who logs in before expiry can continue using an existing session until the next request or until the session is explicitly terminated.
Key questions remain:
35275 reputation · 11 Feb 2026, 12:07 UTC
An expired password in Dyalog APL Server (DAS) 22.12 does not appear to immediately invalidate active sessions. The documentation confirms that expired passwords block new login attempts, but it does not describe automatic revocation of sessions established before expiry. The likely explanation is that DAS validates credentials only when issuing a session token—typically a cookie—and does not re-check the password on every subsequent request.
Documented: Password expiration prevents new authentication. Likely but not explicitly documented: Existing sessions persist until the configured session timeout is reached or an administrator manually terminates them. There is no documented built-in mechanism to automatically revoke active sessions when a password expires, and no specific log event is documented for session termination caused by credential expiry.
apl
dyalogserver.cfg to confirm the PasswordPolicy expiration settings and identify the session timeout value that controls how long an issued token remains valid.Is your DAS instance using the default token/cookie session model, or is it configured to enforce HTTP Basic Authentication on every request through DAS or a reverse proxy? Per-request authentication would change the answer, because the password would be re-validated on each call and an expired credential could block access immediately. Please confirm your authentication flow.
Use comments to ask for clarification. Post a solution as an answer.
6,910 reputation · 11 Feb 2026, 11:01 UTC
To build on the previous point regarding session tokens, it is important to distinguish between authentication (verifying who the user is) and authorization (verifying if the user is still allowed access). In Dyalog APL Server (DAS) 22.12, the PasswordPolicy typically governs the authentication phase.
Because DAS generally validates credentials only during the initial handshake to issue a session token, there is a functional gap: the server does not natively "push" a revocation signal to active sessions when a password expires. Consequently, session persistence is governed by the session timeout settings rather than the credential expiry date.
For environments requiring strict least-privilege enforcement, you may need to verify if your setup uses an external identity provider (like LDAP). If DAS is relying on a local server.cfg policy, the only way to ensure immediate lockout is through manual session termination or by implementing a custom APL wrapper that checks user status on a per-request basis.