Automatically logout user after inactivity

[libertyct]

i need to setup functionality that automatically logs out a user after a certain amount of time of inactivity. how would you go about this task? I am not asking for code, just ideas, i was thinking of using a javascript timer but im not sure if that would work well on a page that uses Ajax since i wont be able to detect any page re-loads.

 

thnx!

[trq]

i need to setup functionality that automatically logs out a user after a certain amount of time of inactivity.

 

PHP does this automatically, I think the default value is 20 mins. Take a look in your php.ini at the session settings.

[revraz]

The PHP.INI holds the Garbage Collector (GC) settings, which determines how often it runs and what sessions get deleted. This may or may not be the result you are looking for.

[libertyct]

well i am looking for a way to automatically redirect to something like a error page eg after 5 mins of inactivity -> logout user -> show inactivity message!

[discomatt]

Use sessions, and adjust the session timings

 

http://bytes.com/forum/thread2477.html might help

 

From what I've read though, you're much better off creating or using a custom session handler ( database-driven is usually best ) for more accurate control.

[Ken2k7]

If you use cookies, you can include a script to be ran for each page. Maybe like in the header of each page? Or if you have a php file that is ran on every page, you can put it there. In that script, you can create a cookie with the time the user last refreshed in UTC format. Then upon every refresh, check if the cookie is set, and if it is, subtract the current time from the cookie time and if that is greater than a certain amount, remove all the cookies for that site. Otherwise, change the cookie time to the current time.

[libertyct]

I have done adjustments to the session lifetime before, so if a user returned to a page and thier session had died out i could redirect them to a logout page, but i want to have this automated, such that the user gets booted automatically without the user refreshing the page. maybe this is something possible on ASP.NET and not PHP?

 

[Ken2k7]

I have done adjustments to the session lifetime before, so if a user returned to a page and thier session had died out i could redirect them to a logout page, but i want to have this automated, such that the user gets booted automatically without the user refreshing the page. maybe this is something possible on ASP.NET and not PHP?

 

 

For that, either use JavaScript timer or HTML META tag with the given amount of seconds specified. So 20 minutes is 20 minutes * 60 seconds = 1200 seconds. Redirect the user to the logout php page when the timer expires and in the logout.php, redirect the user back to the homepage after deleting their sessions.

 

You can use PHP to generate the META HTML if you want.

[discomatt]

I have done adjustments to the session lifetime before, so if a user returned to a page and thier session had died out i could redirect them to a logout page, but i want to have this automated, such that the user gets booted automatically without the user refreshing the page. maybe this is something possible on ASP.NET and not PHP?

 

 

Yes, javascript redirect or meta refresh. Use this as a secondary for sure though, as both are a one-click disable in most modern browsers.