We have a scenario in which we like to detect when the user has left our site and immediately expire their .Net session. We’re using Forms Authentication. We’re not talking about a session timeout, which we already have. We would like to know when a user has browsed away from our site, either via a link, by typing in an address or following a bookmark. If they return to our site, even if right away, they will have to log back in (I understand this is not great usability – this is a security requirement we’ve been given by our client).
My initial instinct is that this is either not possible, or that any solutions will be extremely unreliable. The only solutions we’ve come up with are:
- Add a JavaScript onBlur event handler that tells the server to log out the session when the user leaves the site.
- Once the user has logged in, check the HTTP referrer to ensure that the user has navigated from within the site.
- Add AJAX polling back to the server to keep the session refreshed, possibly on a 10-second interval. When the call isn’t received on time the session would end.
The onBlur seems like the easiest, but possibly least reliable method – I’m not sure if it would even work. There are also issues with the referrer method, as the user could type in an address within the site and not follow a link. The AJAX method seems like it would work, but it’s complicated – I’m not even sure how to handle it on the back-end. I’m thinking there might also be scenarios in which that wouldn’t always work.
Any ideas would be appreciated. Thanks.
I have gone for a heartbeat type scenario like you describe above. Either Ajax Polling or an IFRAME. When the user closes the browser and a certain timeout elapses (10 seconds?), then you can log them out.
Another alternative would be to have the site run entirely on AJAX. Thus there is only one ‘URL’ that a user can visit and all content is loaded dynamically. Of course you break all sorts of usability stuff this way, but at least you achieve your goal.