Question

For example, if I want to set up a trigger that fires every hr passed since the current time, how would I implement that?

I am using PHP to write my backend code, essentially, if a user logged in, I give a sessionID, if there’s no activity every hr , then session timeout. I think it needs to be implement in PHP right?

Answer 1

No need for job scheduling here. When you give them a session ID, store the session ID in a table in your database. Then do this upon every single request:

if session id row is found
    if current time - last updated time > 1 hour
        Do not allow access. Session is expired
    else
        update timestamp of session id row, setting it to the current time
        allow access
    end
end

Essentially: every time the user requests something, you can update a timestamp field in that session’s row in your database. If the current time – last updated time > 1 hour, then the session is invalid and you should not allow the access.

If you wanted to schedule a job to go delete or otherwise deactivate rows that have expired, that’s fine, but your session management scheme should not depend on that.

That said, if you don’t have to roll your own session management, don’t. It’s fraught with lots of little details that are easy to overlook, and could result in leaving your site vulnerable. If you still need to roll your own, check out some of the OWASP materials about session management and authentication:

https://www.owasp.org/index.php/Session_Management_Cheat_Sheet