Session ID

[gregz]

How do you cancel or destroy a session when the user closes out his browser? What I'm trying to prevent is if a user logs in and establishes a session and closes out the browser, another person could open up the browser within the session time and type in the URl and actually access the information from the previous user.
Any ideas?
Greg

[JerryBrightbill]

Re: Session ID

If you are using the Version 8 security, you can set the Login expiration policy to "expire when the user closes the browser"

[gregz]

Re: Session ID

Jerry,
I not useing that. I have a SQL database that has the UserID's. Is there a way to perform this if I'm not using the Alpha login method?

[Steve Wood]

Re: Session ID

I was about to post two ideas, but realized neither will fire just because the browser is closed. I'll list them anyway in case they spur on other ideas:

1) use this javascript to flash an alert after x minutes of inactivity:

<script type="text/javascript">
	setTimeout( 'ShowTimeoutWarning();', 3300000 );
</script>

<script type="text/javascript">
function ShowTimeoutWarning ()
{
    window.alert("Your browser has been idle for 55 minutes. As a security precaution your session will end in five minutes. To continue, either refresh your browser or save your page. If your session has ended, you will have to log back in." );
}
</script>

<meta http-equiv=Content-type content="text/html; charset=unicode">

' above time is in miliseconds. 60,000= 1 minute. 3300000 = 55 minutes

2) See Session.reset() in the Help. This function deletes all session variables (with some specific exceptions). You can also delete session variables with:

delete session.myvar

[gregz]

Re: Session ID

Thanks for the help.
Here is what I ended up doing:

<script type="text/javascript">
<!--
if (document.referrer == '')
window.location = "https://secure.padmin.com/claimsentry/claim.a5w";
//-->
</script>

So, if the user go to the screen without coming from a referrer I send them back to the logon screen.
Works perfect.
Now I just need to figure out if the person closed their browser, so I can end their session.
Greg

[Lenny Forziati]

Re: Session ID

Greg, this approach is probably going to be problematic for you unless you have full control over the clients, as in a tightly controlled intranet setting. Without that control, there are two potential problems.

1) JavaScript can be disabled in the browser, effectively bypassing your protection and allowing direct access.

2) Privacy software, often part of personal firewalls like Norton and McAfee, typically blocks the referrer. These users will always appear to have not logged in even if they have.

So to get back to your original question - there is no (reliable) way for you to end a session when the browser is closed. To accomplish what you want, you will have to either use the Security Framework's timeout options, or implement your own tracking using a cookie that automatically expires when the browser is closed.

[gregz]

Re: Session ID

Lenny, if I turn on the V8 Security Framework, that disables the session time value in the config of WAS. Correct?
Can I use the tracking cookie in WAS or do I need to use JS?
Greg