What is the best way to implement idle time out for web application (auto log off)

Question

I want to implement an idle time-out for the web application that we are building. I had earlier achieved this using AsynchronousSessionAuditor from codeplex, which essentially looks for the formsauthentication and session cookie timeout by constant polling.

But it has a draw back of not respecting the client side events, it will look for only last postback to decide when to log off.

The jquery plug jquery-idle-timeout-plugin from erichynds solves this issue of client side events but suffers from another drawback that is not able to recognise user is active on some other tab.

Is there anyone already fixed the TABBED browsing issue with jquery-idle-timeout-plugin already? Or is there any better approach of application time out for web applications (by the way this web app is build using asp.net f/w)

Answer 1

If I understand your question right, it is not possible, since there are no events triggered in javascript for activity outside of the current window/tab.

Unless you have a addon to go along with your website for each browser, which could monitor all activity in the browser, but that is not really a practical approach.

Answer 2

Well, you'd have to code it by hand, which is not really hard. You can use the onfocus and onblur functions to do something like this:

$(function() {
    window.isActive = true;
    $(window).focus(function() { this.isActive = true; });
    $(window).blur(function() { this.isActive = false; });
    showIsActive();
});

function showIsActive()
{
    console.log(window.isActive)
    window.setTimeout("showIsActive()", 2000);
}

function doWork()
{
    if (!window.isActive) { /* Check for idle time */}
}

If you make a little search you can find that varaieties of this question have already been asked and answered, you can probably find a solution you can implement with one of the plugins you mentioned.

Try: Run setTimeout only when tab is active or How to tell if browser/tab is active

EDIT--> ADDED:

Or I'd try a different approach. You could create a cookie with some hash and save that hash in your DB with a timestamp that updates whenever the window is active (you could check every 5 seconds or something, it's not an intensive request)
Then, do another check before(but in the same request) to see how much time has passed since the last timestamp and log them out if necessary.
it won't log them out isntantly when time has passed, but it will when they try to access the site either by opening it again or by focusing on the tab/window.