how to automatically logout users from my site

[camilin87]

hello.
I'm building a site using php I have a setup.php page wich has at the
begining session_start();
and every single page from my site includes setup.php. When a user
registers I save in $_SESSION["Login"] the userName, so that when !
isset($_SESSION["Login"]) I can redirect him to the login.php page.
After some inactivityperiod, e.g. 20 min, I need that user to be
automatically logged off. Besides I need to keep track of the users
that are online in that moment, so the logout should run some server-
side script too. Can anyone give me some ideas??

[Jensen Somers]

Hello,

ca*******@gmail.com wrote:

hello.
I'm building a site using php I have a setup.php page wich has at the
begining session_start();
and every single page from my site includes setup.php. When a user
registers I save in $_SESSION["Login"] the userName, so that when !
isset($_SESSION["Login"]) I can redirect him to the login.php page.
After some inactivityperiod, e.g. 20 min, I need that user to be
automatically logged off. Besides I need to keep track of the users
that are online in that moment, so the logout should run some server-
side script too. Can anyone give me some ideas??

I handle things very basic and easily. I have a session class which holds all the
information I need to save in a session (user login details, current shopping
list items...) and one of those is the time when the session was created. When
the user moves to the next page one of the functions I call is one that checks
the current time against the saved session time. If the difference between those
is greater than time X I call the logout function and redirect the user to the
login form.

I don't really see a point in checking the login time of the user with some cron
job. If he wants to leave a page open for 2 hours that's fine, he can't do
anything special with it. If he closes the browser the session is destroyed, if
he moves to another page I have the checking routines.

- Jensen

[ajtrichards]

On Jan 19, 11:03*pm, [e-mail] wrote:

hello.
I'm building a site using php I have a setup.php page wich has at the
begining session_start();
and every single page from my site includes setup.php. When a user
registers I save in $_SESSION["Login"] the userName, so that when !
isset($_SESSION["Login"]) I can redirect him to the login.php page.
After some inactivityperiod, e.g. 20 min, I need that user to be
automatically logged off. Besides I need to keep track of the users
that are online in that moment, so the logout should run some server-
side script too. Can anyone give me some ideas??

You could save the username as a cookie and set a expiry time e.g
setcookie("username", "user", "/", "EXPIRY TIME");

Then for each page they load do a setcookie to keep it refreshed with
the timelimit.

[Jonas Werres]

You could save the username as a cookie and set a expiry time e.g

setcookie("username", "user", "/", "EXPIRY TIME");

Then for each page they load do a setcookie to keep it refreshed with
the timelimit.

Yeah great. Or you do something that's not an enormous security hole,
since cookies can be freely created and edited by the user.

Running PHP scripts without the context of an HTTP request is only
possible by using cronjob s or similar things.
So the only thing you can do is saving timestamps of last activity (NOT
IN COOKIES!) and look every minute or so if there are expired ones.

If you would tell us what you are planing to do, we could tell you why
you don't want to do that.

[Jonas Werres]

I don't really see a point in checking the login time of the user with

some cron job. If he wants to leave a page open for 2 hours that's fine,

The session is normally expired than

he can't do anything special with it. If he closes the browser the
session is destroyed,

No, it's not. There is no sure way for the server to determine if the
browser is closed. The session will continue to exist until it expires.
Only the browser will forget how to access it.

[Rik Wasmus]

On Sun, 20 Jan 2008 00:03:14 +0100, <ca*******@gmail.comwrote:

hello.
I'm building a site using php I have a setup.php page wich has at the
begining session_start();
and every single page from my site includes setup.php. When a user
registers I save in $_SESSION["Login"] the userName, so that when !
isset($_SESSION["Login"]) I can redirect him to the login.php page.
After some inactivityperiod, e.g. 20 min, I need that user to be
automatically logged off. Besides I need to keep track of the users
that are online in that moment, so the logout should run some server-
side script too. Can anyone give me some ideas??

Easiest way: define a database storage handler for the session (see
http://php.net/session_set_save_handler), use a table with a datetime or
timestamp field (always updated to the current time on save) and a
blob/text field for the session-data. Define a proper function for the
garbage-collector which uses the settings for a session
(session.gc_maxlifetime), and everything will be done automatically.
Getting information about current sessions now becomes a simple query on
the database.
--
Rik Wasmus