Automatic logout after a specified idle period

[ketankshah]

I want to have the user automatically logout after 5 min. of idle time. How can I do this ? The login_id and password are stored in a database and at the time of login I am checking the validity from that database.

Ketan

 

[Klotzki]

I'm guessing you would like to set it up so that users can not surf around your site after the 5 min expiration.

You have to insert a CFAPPLICATION tag on your application.cfm and specify session timeout.

<CFAPPLICATION NAME=&quot;MyApp&quot; SESSIONTIMEOUT=&quot;#CreateTimeSpan(0,1,30,0)#&quot;>

where session is set to expire after 1 hr and 30mins of inactivity.

HTH.
Klotzki

 

[GunJack]

The cfapplication tag does this for you without any additional coding. You just need to set your session timeout for 5 minutes. After 5 minutes of no activity, they will lose their session and have to login again.

If you want the visitor to only have five minutes on the site though, create a session variable the first time they visit the site and then check each page request to see if the current time is greater than 5 minutes past their start time.

GJ

 

[ketankshah]

Thanks. I managed to do this thru CFAPPLICATION Tag.

 

[mcmoyer]

If your wanting the page to be logged out also, you might try using a javascript like this also:

setTimeout('window.location.href=\&quot;/mylogoutPage.cfm&quot;',1200000);

This will cause the page to load 'mylogoutPage.cfm after 20 minutes of inactivity.

 

[philcha]

As GunJack says, Session variables are the simplest way. But before committing yourself to an approach, check whether the site is ever likely to use clustered servers. If so, don't use Session variables for anything! Session variables live in the server's memory and clustered servers may cause one page to be processed on server A and the next on server B, either for load-balancing or because server A has failed. Result - all the session variables are lost or, worse, servers A and B have different values for them. There's an article by Marc Funaro at

http://www.advantex.com

which analyses the options for clustered servers very thoroughly.

 

[iqof188]

Plus, be very aware that people that visit your site via a proxy server (for example employees at work) will have trouble being assigned a session by CF Server, since those users will all have the same IP-address, i.e. the IP-address of the proxy-server. Things can get really messed up as you can see...

<webguru>iqof188</webguru>

 

[GunJack]

Actually, the session shouldn't be affected by a proxy server since CF uses the cfid & cftoken to maintain client and session variables. With these being stored in cookies, session information can be maintained through proxy servers as long as the visitor has cookies enabled or the CF code passes them via url variables..

GJ