My application currently stores some basic _SESSION events, such as login and each page/URI requested. I’ve been asked to enhance event logging to include tracking when users log out.
The trouble with logouts is that users don’t always remember to click a dedicated Logout button. Sometimes they just leave the browser open, or close the open browser windows, or simply shut down. I can’t always be guaranteed an exact logout event.
I can get a rough idea of user logout times by querying my event table for periods of no activity, however this seems roughshod.
Is there a best practice for detecting passive logouts in PHP?
You basically have your answer – no activity means they have logged out.
If your server can handle it, and it’s really important, you can set a Javascript timeout to “ping”every minute. If you get the ping, then the browser is still on the page, if you don’t, they have probably moved on. Exactly when you define “logout” though is still a little bit of guess work, add the user may leave the page then return later while the session is valid.