How to catach a close event on a website without javascript?

[Sheena777]

How can i catch a close event on a web page without the use of javascript. I have a site that a users has to log in to and from that I have to keep track of if they are logged in or not. My problem now comes when the user has to be marked as logged out. How can I solve the problem that when the browser closes unexpectedly that it then carries out a method that will mark the user as logged out. The log out methods works when the users logs out and then closes the application.

[kenobewan]

I'd look at the application events in the global.asax file:
Working with the ASP.NET Global.asax file

[balabaster]

The application events are only fired when IIS is started/stopped.

As far as I'm aware - please someone yell if I'm mistaken, but so far from everything I've read or been told, the following is true:

Because the client (read: web browser) is completely disconnected from the server, there's no way to detect if the browser is closed without it being told to communicate its action with the server. There are a limited number of methods of doing this: Client script (client side Javascript/VBScript); Java applet; ActiveX control. The simplest is using one of the Javascript methods below:

Javascript Solutions:

1). Send a heartbeat to the server once every xx number of seconds. The server has a timer that counts down to 0. Once the timer reaches 0, the session is dropped and the user once again has to log in. The heartbeat continuously resets the timer to it's starting point so it can never reach 0 so long as the page is open.

2). Set the session timeout sufficiently high that for all intensive purposes it never times out, but when the window is closed a javascript sends a signal to the server to notify it that the page has closed.

ActiveX/Java Applet Solutions:

Embed an active-x or java applet into the web page that does the equivalent of one of the Javascript solutions. My feeling is that the most likely candidate would be option 1.

If no client side scripting or control embedding is possible due to network security restrictions then there is no way to tell the client browser that it must notify the server when its closed or when you navigate away from the site. In which case, you have to rely on the session timeout to kill the session in a sufficiently small enough amount of time that a new session must be started.

Perhaps you could use some trickery to prevent someone from navigating directly to pages within your application by entering the address in the address bar, i.e. some token is passed from page to page. If the token is missing, then the site automatically redirects the user to a starter page where they must log in to obtain this token. Once they have this token, they can only navigate from page to page using links or form buttons - of course, things like postback all require javascript in order to run properly, so if javascript isn't allowed, then a lot of this functionality is rendered useless.

So given that this is the case, you'd have to navigate using buttons, anchor tags wouldn't work as they use GET instead of POST and as such, you couldn't pass a hidden token, which would mean the user could navigate to a page just by pasting the address into the address bar...

[Plater]

If no client side scripting

If that were really the case, NO ASP.NET page would function.
They all rely on javascript.

And the Application functions fire when the application is started/restarted/stopped/etc (which would include when IIS as a whole is started/stopped/etc). It is possible to stop/start/etc a webapplication on IIS without affecting any of the others.

[balabaster]

And the Application functions fire when the application is started/restarted/stopped/etc (which would include when IIS as a whole is started/stopped/etc). It is possible to stop/start/etc a webapplication on IIS without affecting any of the others.

To clarify further the application should be thought of as the application running on the server, not the application running in the web client...(i.e. the pages served to this user within their session).

[boyank]

Here is solution without using JavaScript. It involves more work but it's doable:

1. Create a unique session ID for the user when the user logs in
2. With each session ID also store the login time
3. Set a treshold for inactivity somewhere which indicates after how long the user is considered inactive and/or logged out
4. Run a process on the server to clean up expred sessions that match the login time in #2 + the threshold in #3 where < current time

[Plater]

Here is solution without using JavaScript. It involves more work but it's doable:

1. Create a unique session ID for the user when the user logs in
2. With each session ID also store the login time
3. Set a treshold for inactivity somewhere which indicates after how long the user is considered inactive and/or logged out
4. Run a process on the server to clean up expred sessions that match the login time in #2 + the threshold in #3 where < current time

All that functionality is already built into the Session object (if you use the default "InProc" setting)

[balabaster]

All that functionality is already built into the Session object (if you use the default "InProc" setting)

And in addition to that, all it tells you is the last page load on that session - it doesn't tell you if the window's been closed...