Question

i have a client side jquery script that logs the user off after 5 mins of inactivity. The problem is though is the user navigates away without logging out the session stays active. If the user closes the browser shouldnt that destroy the session since sessions stay alive for the duration of the browsers being open or the user logs off?

anywho this is what i have

(function($){
    $(document).bind("idle.idleTimer", function(){
        document.location = "orders.php?action=logoff&session=timeout";
    });
    //var minute = 60000; //1 minute is 60,000 miliseconds.
    var minute = 300000; //5 minutes
    var timeout = minute;
    $.idleTimer(timeout);

})(jQuery);

how can i implement a server side if the user navigates away? I was thinking of using cron but then that would be not the right way (im thinking but then maybe im wrong)

i read this post
User Inactivity Logout PHP

and i don’t see how the session can still take effect if the user navigates away

Answer 1

Navigating away necessarily doesn’t expire the session, its closing the browser that does.

1. I would implement the check on the server side.
2. If the session is invalid, you should send down a 400 HTTP status code, which your JS code can use to identify that the user is no longer allowed to use the resource and hence redirect to the login page.
3. Set cookies expiry values to something that suits your application better.