Question

I have this code that logs a user out if they don’t change pages for 10 minutes.

$inactive = 600;

if(isset($_SESSION['timeout']) ) {
  $session_life = time() - $_SESSION['timeout'];
  if($session_life > $inactive) { 
    header("Location: logout.php"); 
  }
}

$_SESSION['timeout'] = time();

As you can see it’s pretty straightforward. I include this function at the top of all my protected pages and if the script isn’t run for 10 minutes, the next time you refresh the page, the user is sent to my logout script.

However that’s the problem. After $session_life > $inactive becomes true, the script needs to be run again for the user to be logged out. I need the person to be immediately logged out as soon as this becomes true.

Is there any way to do this without things getting too complicated? (i.e. not using AJAX)

Answer 1

No. Your PHP code runs on every request. If you want the timeout to trigger “immediately” then you have to either spam the server with continuous requests (bad idea) or move the timeout logic to client-side code.

An appropriate solution could be to start a Javascript timer when the page loads and redirect the user to the logout page when the timer expires. If the user navigates to another page in the meantime the current timer would be discarded automatically and a new one started when that page loads. It can be as simple as this:

<script type="text/javascript">
    setTimeout(function() { window.location.href = "logout.php"; }, 60 * 10);
</script>

Update: Of course, you should also keep the server-side code to enforce the business rule on your own side. The Javascript will give you an “optimal” scenario when the client side cooperates; the PHP code will give you a guarantee if the client side works against you.