在一定时间后注销用户

Question

I'm currently storing a timestamp of the users last activity in my database in which if that hasn't been updated for 15 minutes (for testing doing 2 minutes) I want it to log the user out.

I have been trying different things but they all seem to log me out even though they shouldn't be.

Example of something I've tried

    $Online = time() - 120;
    if ($CheckOnline['lastaction'] < $Online){
    header("Location: Logout.php");
    session_destroy();
}

Am I going at this the wrong way.? If I do $Online < $CheckOnline['lastaction'] it keeps me logged in but never logs me out.

Thank you in advance!

Answer 1

Supposing the 'lastaction' is in epoch time format, this would be quite easy. You can check by the current time minus the last action time, that will give you the time in-between the actions. You can do something like this:

$maxTimeAllowed = 120; // 2 Mins
if ((time() - $CheckOnline['lastaction']) > $maxTimeAllowed){
    session_start();
    session_destroy();
    header("Location: Logout.php");
}

I should also mention, in order for you to destory a session you must start it first, but I figure you would handle that logic either in your logout.php or on the page this will be run on, but i've included it just incase.

Another alternative is via javascript.

setTimeout(() => {
   window.location = 'logout.php'
}, 120000) // 120000 because JS counts in milliseconds

That way, this will ensure that no matter what the user will be logged out in 2m, not just when they make another request.

Sidenote: If the date/time in your database is stored not as epoch time, it might be worth using strtotime() to convert them, as epoch time is much easier to work with.