--- a/pkg/config/config.go	Thu Mar 14 10:50:18 2019 +0100
+++ b/pkg/config/config.go	Thu Mar 14 11:15:43 2019 +0100
@@ -19,6 +19,7 @@
 	"fmt"
 	"log"
 	"sync"
+	"time"
 
 	homedir "github.com/mitchellh/go-homedir"
 	"github.com/spf13/cobra"
@@ -106,12 +107,14 @@
 func TmpDir() string { return viper.GetString("tmp-dir") }
 
 var (
-	proxyKeyOnce    sync.Once
-	proxyKey        []byte
-	proxyPrefixOnce sync.Once
-	proxyPrefix     string
-	externalURLOnce sync.Once
-	externalURL     string
+	proxyKeyOnce       sync.Once
+	proxyKey           []byte
+	proxyPrefixOnce    sync.Once
+	proxyPrefix        string
+	externalURLOnce    sync.Once
+	externalURL        string
+	sessionTimeoutOnce sync.Once
+	sessionTimeout     time.Duration
 )
 
 // ProxyKey is a crytographic key to sign the URLs generated by the proxy.
@@ -166,6 +169,20 @@
 	return externalURL
 }
 
+// SessionTimeout is the duration until a session expires if not renewed
+func SessionTimeout() time.Duration {
+	fetchTimeout := func() {
+		if sessionTimeout == 0 {
+			sessionTimeout = viper.GetDuration("session-timeout")
+			if sessionTimeout <= 0 {
+				log.Println("warn: non-positive session-timeout configured.")
+			}
+		}
+	}
+	sessionTimeoutOnce.Do(fetchTimeout)
+	return sessionTimeout
+}
+
 // The root directories where to find schema files.
 func SchemaDirs() string { return viper.GetString("schema-dirs") }
 
@@ -219,6 +236,7 @@
 	strP("db-ssl", "S", "prefer", "SSL mode of the database")
 
 	strP("sessions", "s", "", "path to the sessions file")
+	str("session-timeout", "3h", "duration until sessions expire")
 
 	strP("web", "w", "./web", "path to the web files")
 	strP("host", "o", "localhost", "host of the web app")