Many sites ( Bank webSite for example) - implement log-out + 1 minute warning before session is about to expire.( 20 minutes)
(this topic is not discussed much - the only question ive seen is with using asp.net membership - which I don't use)
each user will have a session["lastActionTime"]
this session will be update to current Time when :
- Page is loaded
- Ajax request has executed ( due to user action)
Now - when a page loads , I set the session value. (lets say 19:00)
Also , for every ajax request (my site doesnt create postbacks - only ajax jquery) - I use an ASHX handler with IRequiresSessionState which updates the session to current Time.
I use something like this :
jQuery(document).ajaxStart(function(){
gotoHandlerAndUpdateSessionTime();
})
Now -the part for 1 minute before warning message ( " your session is about to expire ") :
Every ajax return event or page load event - I activate in javascript : setInterval with [sessionTime-1] minutes ( 20-1=19). ( and of course - cancelling all prev setIntervals... )
now when the event (setInterval) occurs - it is 1 minute before expiration time : (19 min)
I display a warning div , and the user can choose exit or stay .
question :
1) what if the user didnt press nothing on the warning div , How (after 1 minute from displaying the div) will I log him out ? Should I open a setTimeout of 1 minute when displaying the div and then (if nothing pressed) to log him out ?
2) is it the right way of doing it ?
3) Shouldn't there be cookies in this whole weird story ? :-)
(please - no membership - or Forms authentication). I'm tagging this question also as PHP since I know it is relevant to php programmers a