Auto Timeout web application user

[ab042]

If a web application user walks away from there browser and they don't change pages or something for 30 minutes, I need the session to AUTO LOGOUT and return them to a Login page to protect the data from others.

Any suggestions?

[Lenny Forziati]

The easiest implementation would be to set the session lifetime to 30 minutes and store the login state as a session variable. After 30 minutes, the session variable gets removed and they are effectively logged out of your application.

You can see this behavior by visiting our the sample applications on our server. After clicking to see one of the sample pages, you will be prompted to login. The login state is stored as a session variable and the session lifetime on that server is 15 minutes. So login, load a page, wait 15 minutes, then try to load another. You'll find that you are prompted to login again.

If a web application user walks away from there browser and they don't change pages or something for 30 minutes, I need the session to AUTO LOGOUT and return them to a Login page to protect the data from others.

Any suggestions?

[ab042]

Sesssion appears to be timing out with activity?

((This thread should be v7 WEB if you want to move it))

Lenny:

On some testing I'm finding that the session is timing out regardless of activity. For example:
1) Set the session lifetime to 300 seconds.
2) Restart the server
3) Pull up the web application demo that comes with Alpha5 and login
4) Select one of the items
5) Wait 4 minutes and select another (This should give you another 5 minutes)
6) Wait 3-4 minutes and select another and it returns to the Login Page.

I'm I correct in thinking it should be a rolling time based on activity?

I don't want the MAX amount of time a user can be logged in.
I'm looking for a Max Time without any activity before a user is Logged out.

I was thinking the Session.__protected__FlagIsLoggedIn would be set to False if the user didn't have any activity for X seconds. And stay True if the user had activity within the last X seconds.

[robert swanson]

Found the same thing

I have a two monitor setup with the browser on one screen and Alpha on the other. Real handy for making changes.

Today I downloaded 3002 and started to notice that after making a change and publishing, saying a few cuss words, then back to the code to make a change or restore and republish.

I'm back at the login page although its only been 5 min since the last mod.
I finally doubled the WAS timeout. This is something that only turned up today.

[JerryBrightbill]

I don't want the MAX amount of time a user can be logged in.
I'm looking for a Max Time without any activity before a user is Logged out.

Actually, that is what is happening. However, since the server and client (the computer with the browser) only communicate when you request or submit a page, the server does not know what you are doing locally. The "clock" starts at the last server activity for the current session and then times out is there are no server requests. Since you are editing the page on the local browser, but haven't submitted it, the server will time out. It does not see your "activity" on the browser. The "clock" is reset only when a page is submitted or requested.

You could probably write some javascript to do what you want on the local browser, but the only way to restart the session timer is some command back to the server.

[ab042]

I selected a totally different page so its not coming from the local cache and should be another request to the server.

ie: It should extend the time shouldn't it?

Is there anyway to see this session time stamp of the last submit or request on the server by session so I can better debug it??

[robert swanson]

Jerry I'm using the local WAS so I'm issuing requests to the server every 5 minutes or so. It should not have timed out. Also its important to note that this behavior onlty started with the installation of 3002.

[Lenny Forziati]

session.timestamp wlll show you the timestamp of the most recent request. But as soon as you request a page, you are running a request and it is the most recent request. As a result, session.timestamp is essentilly always the current time on the server.

There is no way to see the timestamp of the previous request. I will look into adding this. But even if it were available, when a sesison expires its entire contents are deleted and this would include and previous timestamp as well.

I am taking a closer look into premature session expirations now.

I selected a totally different page so its not coming from the local cache and should be another request to the server.

ie: It should extend the time shouldn't it?

Is there anyway to see this session time stamp of the last submit or request on the server by session so I can better debug it??

[Lenny Forziati]

I was thinking the Session.__protected__FlagIsLoggedIn would be set to False if the user didn't have any activity for X seconds. And stay True if the user had activity within the last X seconds.

When a session expires, everything it contains is deleted. So instead of Session.__protected__FlagIsLoggedIn being changed to false, Session.__protected__FlagIsLoggedIn is deleted

[Lenny Forziati]

I found a situation where the session timestamp would never get updated after the initial request. In this case, your session would time out regardless of user activity once the specified amount of time had elapsed since the first request.

This has now been fixed and will be part of the next patch. I don't know right now when that will be, but I will find out and update this thread.

[Lenny Forziati]

The next patch should be available either today or tomorrow.

This has now been fixed and will be part of the next patch. I don't know right now when that will be, but I will find out and update this thread.