I have a situation that I want to warn the user that they have exceeded their inactivity period for the session and have been logged out. But to do so the browser must hit the server again to allow the server to sense the user has exceeded the inactivity period and return an appropriate page. I've used a META tag to cause the refresh and that works OK. The exception is when the user is doing activity in second browser window which keeps the session activity counter going. When the first browser hits the META refresh that page is reset to the top of the page. I have not been able to figure out how to get a browser to refresh but still keep it's position - much like hitting the back button. Can anyone assist me in the situation?
They are just HTML. There all part of a single session that I want to time so I can cancel the session if they are inactive for more that 30 min. The rub is there can be multiple window open for the logical session. Any click in the session always goes through my server so I can reset the inactivity timer. I'm trying to warn the user when time has expired. So I have to get each of the windows to refresh so the server can check the timer and respond with an appropriate message or do nothing. I have everything working except the situation where I'm working in a secondary window and the primary window refreshes to check the server. If the inactivity timer has not reached the 30 min limit. I have nothing to respond back to the user. However the page (due to the refresh) has now positioned itself back to the top. This is very annoying and provide a confusing user experience. Can you suggest an alternative technique?
Thanks
Joe
I wrote a small function in PHP, that checks for the session (cookie). If it doesn't find a cookie (means, the session expired), I execute some code in PHP using header() to reroute them. Means I log them out visible.
The following page reads a statement that they have been logged out due to the session being expired or whatever, and the page has a new login prompt.
PHP Code:
if ( session_is_registered ("some_var_I_saved_in_the_session") == FALSE) {
session_destroy(); // not needed, just to make sure
header ("Location:index.php?logged_out=1");
}
The reason why I would recommend using something like PHP, is that it's on the server side. It will "always" work.
Thanks for the server-side technique. Will this work even if the user has not hit enter or click on anything on the browser page?
In other words: for this to work doesn't the user's browser have to do a server request for the server to send them the message to redirect them to the page explaining they have been inactive too long and they have to logon again to continue? Or can a server send a response to a broswer at anytime regardless of the browser's state?
If he goes to a page, what my code is suppose to do is, checking if he is still logged in. If he is not, he gets redirected to a new login screen.
I think if you wanted to log the user off without him doing anything, literally just sitting there, what you would need to do is implement a JavaScript (JS) counter that does some sort of thing (reroute, popup, ...) when he is logged out due to inactivity.
However, a JS solution depends extremely on the client. If JS is turned off, the users will get nothing.
What happends if a server send a response to an IP without first the browser sending a request? Is that possible? Or must a browser send a request first. I'm talking about a situation where the server has already started a session with a particular browser. Can the server send anything to the browser at anytime since it knows the browser's IP and is already in session with it? Have you ever done something like this? Does this make sense?
I don't know if it makes sense, but I know what you are getting at. You want the user to know that he has been logged off, without the user doing anything, just being idle.
If you want to rely on JavaScript, I'd use a timer. If the timer reaches e.g. 240 seconds (4 minutes), you can redirect the user or make a popup saying "You are logged out" (and of course killing the session in the back).
However I think it's far too complicated. I'd still say, do a check up whenever the user requests a page, meaning, if he had been idle before (and got logged off), just reroute to a page telling him.
That's easy to achieve and user friendly as well, 'cause he will be watching the screen when it happens, he won't return and "something" has happened to his browser and the page it sat on, and he doesn't know why.
The JavaScript technique works well except the single browser can not tell if the user has been inactive in the session because the user could have more than one browser window open utilizing the web app. Thus the first window's timer would expire and display an incorrect message. If that first browser window hits the server when the timer expires the server could check if the user has timed out and respond with an appropriate message. The problem I face is when this happens and the user has not timed out I would like the browser to not change at all.
It doesn’t sound like this behavior is possible. I'm I spinning my wheels here?
You have been very helpful and I appreciate your assistance. Can you suggest other sites I can get additionally involved in solving this situation?
Well, I guess you'd have to somewhat define a framework (like how many windows) etc..
I don't have any other recommendations for you. I would look into JavaScript a little (by the way, you can always refer to all the windows that are open and close them on request), if that is what you want to use. If you have any additional questions, feel free to ask.
Subscribe
Browser refresh technique
Additional detail
Linear Mode
