qoliberdocs
Sign in
qoliberdocs
4 min readNov 2, 2026by jakub

Changelog

Current version: 1.0.0

[1.0.0] - 2026-10-30

Commercial rebuild of the open-source qoliber/m2-customer-timeout-popup (2.0.0) under a new name and module (Qoliber_CustomerSessionPopup). Settings saved by the free module are imported on setup:upgrade.

Added

  • Countdown that follows the real server session through the qoliber_session_expiry cookie, written with the session cookie on every response that renews the session; built-in full page cache and Varnish aware.
  • Session lifetime detection for files, database, Redis and memcache storage, with an optional override and a read-only explanation in the configuration.
  • One countdown for every open tab; "Stay signed in", "Sign out", "Sign in again" (back to the same page) and "Continue as guest".
  • Background keep-alive for customers who are using the page. A page scrolling by itself does not count as use, and a failed attempt is retried silently.
  • The idle limit is enforced on the server before every storefront action and every REST or GraphQL call made with the session, so it holds with no storefront script running. Requests Magento rejects are held to it too, and no response renews a session past it.
  • The session ends on the server when the countdown reaches zero; customer data and the mini cart update. The server refuses to end a session that was renewed in the meantime or still has time left, and "signed out" is only shown once it has confirmed; a failed or unanswered request is reported to the customer and retried twice.
  • The countdown is based on the server's issue time, read on the browser's clock after measuring it against the server, so a cookie the browser saw late cannot show a full lifetime.
  • Accessible alert dialog (focus trap, Escape, screen reader announcements) and optional countdown in the tab title.
  • Store-view texts with translated defaults; Luma styles with CSS custom properties.
  • POST endpoints that require the form key; no endpoint is ever cached. Return URLs must match the exact origin of one of the installation's stores and be printable ASCII.
  • The decision is made when a request arrives, so a slow request that was in time, such as placing an order, keeps its customer signed in.
  • A signed-out customer's next session starts empty: nothing of the old one, such as a password reset in progress, carries over to the next person on the browser.
  • A page rendered under a vary cookie that no longer describes the visitor stays out of the page cache, so a page rendered at the moment a session ends is never served to other customers.
  • The session endpoints keep a customer's vary cookie, including their store and currency, and renew its lifetime.
  • The signed-out message hides the page behind it, and leaving it reloads the page.
  • Tabs of one browser do not end a session while another tab is renewing it.

Removed

  • The free module's GET /V1/customer/prolongSession REST route and its Qoliber_SessionTimeoutPopup code.

Verified

All on the final code, with the code on each instance compared to the source and found identical.

  • Browser suite of 51 tests on Luma and Hyvä (102 runs), against compiled code:
    • Magento Open Source 2.4.6-p15, PHP 8.1, Hyvä 1.3.0: 82 passed, 20 not applicable.
    • Mage-OS 1.0.6 (Magento 2.4.7-p4), PHP 8.2, Hyvä theme 1.4.11: 83 passed, 19 not applicable.
    • Mage-OS 2.2.1 (Magento 2.4.8-p4), PHP 8.4, production mode, Varnish 7.5 with Magento's VCL, Redis sessions and cache, installed from release archives: 95 passed, 7 not applicable.
    • Mage-OS 3.5.0 (Magento 2.4.9), Hyvä 1.5.3: PHP 8.3 and PHP 8.5, 83 passed, 19 not applicable each.
    • Not applicable: the live Varnish tests where there is no Varnish, checkout and remember me on Hyvä, and the strict CSP test on Luma and on Hyvä 1.3.0, which has no CSP theme.
  • 69 integration tests on PHP 8.3, 8.4 and 8.5 with no risky tests; 68 of them on Magento 2.4.6 and PHP 8.1, the other needing a Hyvä CSP theme.
  • 167 unit tests on PHP 8.3, 8.4 and 8.5, and on PHP 8.1 and 8.2 against older framework classes. 76 storefront engine tests, also against the production-minified script.
  • PHPStan level 8 including templates, PHPStan range check, PHPCS Magento2 at every severity, PHPCompatibility 8.1 - 8.5, Rector floor guard, ESLint with the Magento rule pack, php -l on 8.1 - 8.5.
  • Release archives: built with git archive, checked for test code and credentials, installed with Composer into a fresh instance, compiled and deployed in production mode. Refused next to the free module, and settings imported from it at their own scope with the HTML removed.
  • Upgrade to a newer version and back, and rollback to the free module and forward again, in a maintenance-mode deployment. The store came back each time and merchant settings survived.
  • 17,254 requests of mixed guest and customer traffic on the production stack: no server error, no wrong sign-out.
  • 983,040 return URLs fuzzed against the real Location header.

Not tested: Adobe Commerce, Hyvä Checkout, Mage-OS 3.6 and 4.0, CDNs, and real customer traffic.

Changelog — Customer Session Popup — Marketing — Extensions | qoliber Docs