473,563 Members | 2,724 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Monitoring logged-in users with sessions: autologoff

Hi all,
I'm currently relying on logged-in users hitting "logout"
(logoff) before they leave, in order to terminate the session.

With PHP the session filename is in a cookie that lasts for the
current session. The problem is that the server does not know
when the current session expires. (I have quite long timeouts.)

Did anybody attempt a script to automatically call "logout"
when the session expires? It seems quite complicate, as there
are multiple urls that share the same session and the user is
not actually logging out until one of them is open in some
client window.

Any better ideas?

TIA
Ale

Jul 23 '05 #1
4 1233
>I'm currently relying on logged-in users hitting "logout"
(logoff) before they leave, in order to terminate the session.

With PHP the session filename is in a cookie that lasts for the
current session. The problem is that the server does not know
when the current session expires. (I have quite long timeouts.)
Then keep track of the timeout yourself.
When the user logs in successfully, set $_SESSION['last_hit']
to the current time. When the user hits a page, check his
login INCLUDING that $_SESSION['last_hit'] being not too old.
If it is too old, redirect to the login page.

If the session is valid, and you want to count the timeout from
the last hit, not the time of login, set $_SESSION['last_hit']
to the current time.

Did anybody attempt a script to automatically call "logout"
when the session expires?


You can't send a page to the browser spontaneously.
You can invalidate the login. With the above procedure,
you don't have to actually DO anything to expire the session
at the time it expires, just check if it has expired at
each page hit.

Gordon L. Burditt
Jul 23 '05 #2
Yup, I'm keeping track of login and last_hit times. However, the server
is not able to distinguish between a user who is taking a long time to
post an update from a user who killed the browser window without
hitting logoff. (The purpose is to just warn them when more than one
is updating the same data.)
You can't send a page to the browser spontaneously.


I could use the onBlur feature to automatically load logoff.
Perhaps I could use a frame, where an invisible page stays there
just to confirm that the user's session is still valid. Many sites,
e.g. PostNuke, display to a user what other users are currently
logged on, so I don't want to reinvent the weel...

Jul 23 '05 #3
>Yup, I'm keeping track of login and last_hit times. However, the server
is not able to distinguish between a user who is taking a long time to
post an update from a user who killed the browser window without
hitting logoff. (The purpose is to just warn them when more than one
is updating the same data.)
If you are really trying to track simultaneous updates to the same
data, you need a lot more than login information. And isn't the
time to do this when the user submits the conflicting change?

What's your purpose in trying to tell when a user has "logged off"
(whatever that means)? Invalidating a session after a certain amount
of time addresses the "unattended keyboard" security issue (and
doesn't require dealing with the browser at all). If this isn't the
point, what is?
You can't send a page to the browser spontaneously.


I could use the onBlur feature to automatically load logoff.


It's this sort of thing that is a major reason Javascript is Turned Off(tm).
Perhaps I could use a frame, where an invisible page stays there
just to confirm that the user's session is still valid. Many sites,
e.g. PostNuke, display to a user what other users are currently
logged on, so I don't want to reinvent the weel...


If your purpose is to display who's logged on, that info is suspect
at best. You can't tell the difference between someone who is still
entering an update and one who has been arrested (leaving his browser
open) and is serving a life sentence, except by the magnitude of
the idle time. Oh, yes, there's also computers crashing, power
failures, and suddenly getting disconnected from the Internet via
dialup lines (call waiting, line noise, someone picks up extension
and starts dialing, etc.).

I suspect those sites displaying users logged in are using timeouts
and not worrying too much about accuracy.

Gordon L. Burditt
Jul 23 '05 #4
>> (The purpose is to just warn them when more than one
is updating the same data.)
If you are really trying to track simultaneous updates to the same
data, you need a lot more than login information. And isn't the
time to do this when the user submits the conflicting change?
I used to provide for sending data's timestamp as a hidden field
and checking it before executing the update when it comes back.
It is an expensive style of coding, not always strightforward,
and seldom firing: users often work in the same office, know
what everybody else does, and apply human reasoning. Thus I've
decided I'll just warn them if they enter in the same logic area.
One logic area has its own cookie name and corresponding list of
sessions. The server maintains a session-group's list in a file
named after the cookie: on each request, the server deletes from
the list any session-id whose corresponding file doesn'exist any
more.

The other use of sessions is to store confirmation messages,
e.g. "your move operation succeeded: it moved 24 items".
Concurrency warnings, e.g. "user smith logged off at 10:44:35,
no other user is logged on", are appended to confirmations.

The resulting code is quite compact and smoothly portable to
different logic areas. One difficulty is adding the logoff link
to every page, which increases the likelyhood that the user
does not logoff... :-(
You can't tell the difference between someone who is still
entering an update and one who has been arrested (leaving his
browser open) and is serving a life sentence
However, the prisoner can get a mercy or ask to a relative to do
something with the browser for him. After the browser dies, there
is no way to reach the session on the server, except searching
all sessions in a group for the given user-id. That way a user can
delete all non-current sessions he owns, i.e. all sessions having
his user-id except the one issuing the "force logoff" command.
I suspect those sites displaying users logged in are using timeouts
and not worrying too much about accuracy.


Yes, and probably they have short (~300 secs) timeouts. I will wait
until next day, still shorter than life sentences, in most cases :-)

Jul 23 '05 #5

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

0
1142
by: Stephen Hillyer | last post by:
Does anyone know of a way to get SBS monitoring to log to SQL 2000 enterprise rather than the Desktop SQL Engine? I have an SQL Server running the databases for WSS, and have removed this instance from SBS, but I cannot find out if it is possible to move the monitoring database off SBS, or upgrade the desktop SQL engine to SQL 2000 (sp3) on...
0
937
by: csomberg | last post by:
SQL 2000 SP3 Howdy all. I saw some code out there somewhere that logged deadlock info including SQL code that caused it as well as the user information. Any ideas ? Thanks,
1
5471
by: Daniel Chou | last post by:
Hello, I have two questions about "not logged initially": 1. Before using "alter table tbname activate not logged initially", should the table be created with "not logged initially"? 2. After using "alter table tbname activate not logged initially", how to deactivate it?
0
1799
by: msnews.microsoft.com | last post by:
No clue why I get this error. It doesn't happen on my local machine. It doesn't give a clue as to where it occurs. Any way to track this? I'm not even sure if it's affecting the web site. It seems to run fine regardless of the error. ------------------- System.Web.HttpException: Invalid file name for monitoring:...
0
1005
by: athos | last post by:
Dear guys, Now we are trying to build an Audit-Log module for our projects. The idea is to 1. develop a module that could be used by different projects to save the log, including account management, master data, and transaction data actions. 2. based on the requirement of each project, use SSRS to define different reports showing...
1
1229
by: John | last post by:
Hi My webform works fine on local dev server but when uploaded to a remote host it comes up with the following error. What is the problem and how can I fix it? Thanks Regards
1
1985
by: Jo | last post by:
Hi. I have a few questions regd event monitoring. Would appreciate some assistance with this. 1. Does the event monitor only insert data into the event monitoring tables once the connection has been disconnected? sometimes when i select from the tables the data does not show current connections, only when i use the FLUSH command the data is...
4
1525
by: natG | last post by:
Well folks, I didn't heed the warnings (that excessive monitoring, statistics, etc. can cause a performance hit) and I have been playing around with all kinds of monitors, snapshots, especially with the gui. BUT! Performance has dropped 70%! The monitors show that the the most system overhead is caused by these selects themselves. Question 1:...
5
1997
by: rohit | last post by:
hi, i am designing a desktop search engine using python. i am having a query , is there a package available that contains functions for retrieving the files being edited , created,deleted in the file system. thanks
0
2949
by: aleu | last post by:
Hi, I was wondering whether any of you is monitoring MSSQL server 2005 (whatever information could be obtained) from a remote Linux server with the use of SNMP or WMI-perl scripts (for example via MRTG or Cacti)? Is something like that even do-able with MSSQL 2005? Could you share some information on your monitoring solution? Thanks,...
0
7659
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main...
0
7580
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language...
0
7882
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. ...
1
7634
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For...
0
6244
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then...
1
5481
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes...
0
3618
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
2079
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
1
1194
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.