实施自动注销

Question

I need a way to auto log out a user after 10 minutes of inactivity. This includes when they leave the browser.

I use this code for all pages that require log in:

function CheckLogin()
{
     if(!isset($_SESSION))
     { 
     session_start();

     }


     $sessionvar = $this->GetLoginSessionVar();

     if(empty($_SESSION[$sessionvar]))
     {
        return false;
     }
     return true;
}

Also, previous ways I've done it is it would require one to go back to the homepage and then they would be auto logged out. Is it possible that they don't need to go back to the page?

Answer 1

Yes. session.gc_maxlifetime is exactly what you are looking for:

ini_set('session.gc_maxlifetime', 600);

http://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime

Answer 2

There are two ways to go about implementing your timeout. One from the server side and one from the client side. Arguably the server side implementation is more important as the client side functions only offer a more enjoyable user experience, and don't actually interact with your application's authentication in anyway.

Server Side

You'll need a login check function which ensures the user is logged in. You've mentioned a psuedo function in your question, so I'll just expand from there.

 function CheckLogin()
 {
      // Is the user logged in?
      if(session does not exist)
      {
           // redirect
           // redirect or return false
      }
      else
      {
           if(session is valid)
           {
                // user is logged in
                // redirect or return true
           }
           else
           {
                // redirect or return false
           }
      }
 }

Client Side

You'll need jquery, and the plugin Jim linked to, http://www.erichynds.com/jquery/a-new-and-improved-jquery-idle-timeout-plugin/ . Create and link to a Javascript file and include it site wide. Follow the documentation in the link for the plugin. It's fairly thorough.

It's also in your best interest to set any cookies associated with the session (if there are any) to timeout after 10 minutes.

Answer 3

there is also a JQuery plug-in called idle timeout that works great. Set two or three parameters, including where to send people when they timeout. Here is the link http://www.erichynds.com/jquery/a-new-and-improved-jquery-idle-timeout-plugin/