Session Expire

[fanfavorite]

I noticed on things like my RBC Online Banking, that if I leave the page idle and then go back to it, it will automatically redirect to the login screen if the session had expired, not letting anyone to view the page that is currently open.  This is what I am trying to acheive.  I currently have it to expire after 20 minutes of idle time and when a page is loaded/refreshed, it will redirect to the login page.  This however allows the user to view the page left open for as long as they wish.  Is there a way to have it redirect? 

 

I was thinking maybe do a setInterval("checksession()",60000); every minute to check if the session still exists and if not, then redirect to login, will this work or is there a better way of doing this?

 

Thanks. 

[Psycho]

You don't need to check every minute. I'm not even sure JavaScript can determine if the session is active. Just create a JavaScript function to initiate based upon the session timeout set on the server using the setTimeout() function and have it start on page load.

 

For example, if the session timeout is 20 minutes. You could do a setTimeout() to call a function at 15 minutes with an alert telling the user that there session will expire in 15 minutes giving them the option to keep the session active. That could be achieved by having a positive response either refresh the page, or having an AJAX call to an empty page. The latter option is better in my opinion because you don't have to worry about saving the user's data before a refresh.

 

Then also have a setTimeout() at 20 minutes to direct the page to the login page.

[fanfavorite]

The problem with that is that it will notify them at 15 minutes regardless of whether the session is going to expire or not.  I was thinking that if I check every so often, then I could see if the session was active.  If javascript doesn't do it directly, I could use php in the javascript and do something like:

 

var checksess = '<? echo $_SESSION[login]; ?>';

if (checksess == '') {

    window.location = "http://www.mydomain.com/login.php"

}

[Psycho]

The problem with that is that it will notify them at 15 minutes regardless of whether the session is going to expire or not.

 

Well, if the user hasn't navigated to another page in 15 minutes they their session will expire in another 5 minutes (assuming a 20 minute session timeout). The session doesn't get updated if the user doesn't make another request from the server (i.e. page load).

 

Now that method does have some drawbacks. 1) Would not account for a user who has the site open in multiple windows and 2) Does not account for AJAX request. But for #2 you could simply reset the counter on the user side.

 

I took a look at the JS code for a site I user that does what you ask. It looks as if the code utilizes a cookie to track the session timeout. I would assume it resets the cookie on each page hit. Then the javascript checks the cookie periodically and alerts the user that the session will expire and if it does expire directs the browser to an appropriate page. That would solve provlem #1 above, but I don't think that would work for pages that use AJAX - if you use that.

[fanfavorite]

Thanks bud, that steers me in the right direction. I will do some playing around.