# Authentication Timeout

You can specify a timeout to limit how long the server will wait for a client to authenticate.

If you don't specify a value, or if you specify the value "0", then the default will be 1 second more than the `tls_timeout`.

If you do specify an invalid value, it will use a default of 1 second.

If a client doesn't authenticate to the server within the specified time, the server disconnects the server to prevent abuses.

Timeouts are specified in seconds (and can be fractional). Unlike `tls_timeout`, you cannot use "human readable" values like `10s`, you must specify a number, which will be interpreted as seconds. `10` will be 10 seconds, `3.5` will be 3 seconds and 500 milliseconds, etc.

As with TLS timeouts, long timeouts can be an opportunity for abuse. If setting the authentication timeout, it is important to note that it should be longer than the `tls timeout` option, as the authentication timeout includes the TLS upgrade time.

```
authorization: {
    timeout: 3
    users: [
        {user: a, password b},
        {user: b, password a}
    ]
}
```