Session Timeout (Again)

[scrimej]

Re: Session Timeout (Again)

So I thought I had this thing figured out with the help from everyones comments. I guess not!!

I put a static text on a UX, added a clientside onTimer set to fire every 60 seconds that does a callback to increment a session variable by 1 and then update the value of the static text to display the number of times the callback has occurred. The ux is then set as the homepage URL for a tabbedUI.

Once the static text rolled to 14 (meaning 14 minutes had elapsed and my session variable was not set to a value of 14) I got the popup warning that my session was expiring in 60 seconds???? I was hoping that by doing a callback and incrementing a session variable that my inactivity would be reset.

Did I miss something obvious? Screenshot with server side xBasic is attached...

Thanks
Jeremy

SessionTimout.png

[scrimej]

Re: Session Timeout (Again)

Some additional information. If I let the session expire, I get the Your Session has expired notification. I click ok and the form resets (I haven't added security to this application yet). When the form resets, the display label goes invisible and after 60 seconds when the callback occurs it reappears picking up where it left off + 1. Since my session expired I assumed it would restart the counter to 1. However it went from 15 to 16.. and at 30 when it timed out again it goes to 31, 32, 33..

[lvasic]

Re: Session Timeout (Again)

Rich, my Main Menu is a UX Component, OnInitializeComplete I run this function: idleLogout();

function idleLogout() {
var t;
window.onload = resetTimer;
window.onmousemove = resetTimer;
window.onmousedown = resetTimer; // catches touchscreen presses
window.onclick = resetTimer; // catches touchpad clicks
window.onscroll = resetTimer; // catches scrolling with arrow keys
window.onkeypress = resetTimer;

function logout() {
{dialog.object}.buttonClick('BUTTON_LOGOUT'); /// I have a button on the main menu to logout. So in this case I click on the button here.
}

function resetTimer() {
clearTimeout(t);
t = setTimeout(logout, 720000); // 720000 = 12 minutes. 1000 milisec = 1 sec. time is in milliseconds
}
}

[Peter.Greulich]

Re: Session Timeout (Again)

Both the tabbed_ui and the UX have a session timeout feature under properties. It gives the user a chance to refresh the session before it expires. If the user is not there, presumably it times out the session, which I think would be desirable. I say 'presumably' as i have not used this myself. It's also shown in a video - search on 'session' and look at tabbed_ui (5 videos).

[Peter.Greulich]

Re: Session Timeout (Again)

Peter, this is a bit off the original topic, but since you brought it up in post # 10....

See what happens if you leave the test app open, after clicking the "set var" button, and then open another instance of the browser to that page. The other instance of the browser will probably have access to that same session variable and it will already have been set without clicking the "set var" button! This can be very troublesome if a user opens two instances of an application and the two instances need different values in their "session" variables.

Hi Rich,

Understood. But that is standard browser behavior. The same thing happens if I, say, open up my Bank of America account in one browser instance and then open another and copy the url to the 2nd instance. I don't have to log in again, I'm right in the account page.

[RichCPT]

Re: Session Timeout (Again)

Thanks lee, that is most helpful - attaching functions to the window events. Although, after looking into it, I'm wondering if it would be safer to use addEventListener()? https://www.w3schools.com/js/js_html...ntlistener.asp

[lvasic]

Re: Session Timeout (Again)

Peter,
There is a nuance here from the Alpha way. Rich is making sure that the session never gets timed out. So if it never gets timed out, how can we override that if the user leaves his screen open? So if the keyboard or the mouse is not touched for a period of time then it will log off.

[Peter.Greulich]

Re: Session Timeout (Again)

So the issue is not timing out, but explicitly logging out while unattended?

[RichCPT]

Re: Session Timeout (Again)

Jeremy,
If you automatically keep the session alive using the method I suggested then you omit Alpha's method of trying to warn the user that they will be timed out. However, Lee has a good suggestion of adding more code to mine that detects inactivity.

My application is one that a user will use throughout their 10 or 12 hour work-shift. It must function like an application that you would normally leave open all day, like email.

[peteconway]

Re: Session Timeout (Again)

Thanks Lee, I don't go down that path - they need to logout if they are not continuing as session, just like email.

[lvasic]

Re: Session Timeout (Again)

Peter, that's exactly what my users want too. They want it to work like a desktop application. So I'm actually not going to implement the idleLogout() function. Do you ever have problems with this? Do users stay on for days?

[scrimej]

Re: Session Timeout (Again)

Thanks again Rich, that did the trick.

For others using this thread to trick session timeout, here's where I went wrong.
I implemented everything Rich stated, except I missed/overlooked/didn't understand the piece about unchecking the property on my TabbedUI that tells your application to "Display warning before session timeout"

My first attempt I left this checked, making the assumption that my xbasic callback was resetting the Alpha Timer the same way it would on any other callback that extended my session timeout.
However, no matter what I tried, after 14 minutes of no activity I always got the Alpha warning telling me my session was about to expire in 1 minute.
Somehow there must be a way to force a reset on that timer so my callback behaves exactly like any other activity that resets that timer. For now, that's not as important as getting this functionality in place.

Once the light bulb came on, I cleared the property and have been able to keep my session alive longer than the 15 minute default.

Thanks for everyones help and comments!!

[peteconway]

Re: Session Timeout (Again)

Never has any issues Lee. Users just prefer it. An Example may be a doctors clinic, and patients may show up over say over 10 to 20 minutes period or longer, they don't want to have to login then check them in.. Just easier.

[drgarytraub]

Re: Session Timeout (Again)

Hi Peter,

Boy, you are a life saver. That is exactly what I needed.

[RichCPT]

Re: Session Timeout (Again)

For this resurrected thread: Something Pete mentioned in post # 10 reminds me of what a user did last month: He configured his Chrome browser to "Continue where you left off" under the "On Startup" options in on the "Settings" page!

That absolutely messes everything up that we are trying to do here with Alpha and session variables and authenticated logins.

I told him he'd have to turn that option off. Surely that is not what other web sites tell their users, right?