My Android application has an inactivity timeout. On a timeout, I return the user to the ‘Sign In’ screen which is (always) in the back stack. My SignIn class has android:launchMode="singleTop" set so the instance running in the backstack is always reused.
I start this intent on timeout:
Intent inactivityTimeout = new Intent(this, SignIn.class);
inactivityTimeout.putExtra(INTENT_EXTRA_INACTIVITY_TIMEOUT, true);
int flags = inactivityTimeout.getFlags();
flags = flags|FLAG_FROM_BACKGROUND|Intent.FLAG_ACTIVITY_CLEAR_TOP;
inactivityTimeout.setFlags(flags);
When the SignIn screen starts up, it checks for the INTENT_EXTRA_INACTIVITY_TIMEOUT Intent extra. If found, it shows a “You’ve been Signed Out” dialog. This is all working correctly.
Now I’ll get to the problem: Since it’s based on a timer, this Intent can be fired off regardless of if my application is in the foreground or background. This is desired as I wouldn’t want the app to stay logged in indefinitely just because it’s in the background.
However, when the application is in the background and the timer expires, this inactivityTimeout Intent is fired off and the application is brought back to the foreground. It’s not urgent to alert the user right now that they’ve been timed out, so I’d prefer the app stays in the background so as to not interrupt the current action.
I tried adding the FLAG_FROM_BACKGROUND flag to my Intent but the application is still brought to the foreground. I’m not certain what else to try, or if this is a problem that I should be addressing in my Intent or in my receiving activity.
Can anyone suggest a way to implement this in my Intent (or in the responding activity?). Or am I missing something conceptual here? Thanks!
There is no need to proactively revoke credentials due to age. After all, the process may well terminate before the user ever tries to reuse those credentials.
Each activity needs to check to see if the user has valid credentials. In that check, you also check for age, and simply fail the credential check if the credentials are correct but too old. And, on a failed credential check, you bring up your login activity.
This allows you to dump the timer.