Many sites ( Bank webSite for example) - implement log-out + 1 minute warning before session is about to expire.( 20 minutes)(
this topic is not discussed much - the only question ive seen is with using asp.net membership - which I don't use)each user will have a \[code\]session["lastActionTime"]\[/code\]this session will be update to current
Time when :
- Page is loaded
- Ajax request has executed ( due to user action)
Now - when a page loads , I set the session value. (lets say 19:00)Also , for every ajax request (my site doesnt create postbacks - only ajax jquery) - I use an ASHX handler with \[code\]IRequiresSessionState\[/code\] which updates the session to current Time.I use something like this : \[code\]jQuery(document).ajaxStart(function(){ gotoHandlerAndUpdateSessionTime();})\[/code\]Now -the part for 1 minute before warning message ( "
your session is about to expire ") : Every ajax return event or \[code\]page load\[/code\] event - I activate in
javascript : \[code\]setInterval\[/code\] with \[code\][sessionTime-1]\[/code\] minutes ( 20-1=19). ( and of course - cancelling all prev setIntervals... )now when the event (setInterval) occurs - it is 1 minute before expiration time : (19 min)I display a warning div , and the user can choose exit or stay .question : 1) what if the user didnt press nothing on the warning div , How (
after 1 minute from displaying the div) will I log him out ? Should I open a setTimeout of 1 minute when displaying the div and then (if nothing pressed) to log him out ?2) is it the right way of doing it ?3) Shouldn't there be cookies in this whole weird story ?
(please - no membership - or Forms authentication).I'm tagging this question also as PHP since I know it is relevant to php programmers as well and I would like to hear from their knowledge.