session expiration

anakadote

Hi. How would i go about causing a session to expire, or more importantly causing php to change a mysql value when a session expires or someone closes the browser window.

i want to keep track of online users so when someone logs in a mysql column value changes accordingly. when they log out, the value changes back. i need to know how to change that value when they just exit by closing the browser window.

thank you

justsomeone

Most people never log out.

You could use a combination of client and serverside here.

Every time a your users access a page which requires them to be logged in, do all your normal validation to ensure that they are logged in, then update a "last access" timestamp on their user record with the current timestamp
Have a logout page which tidies everything up the way you want.
Use a javascript timed redirect to redirect after 30 mins (or 5mins or whatever you think) to a logout page which forces a redirect to the logout page
have a cron job which searches for "last access" fields which are older than the above number of minutes and for those users, force a logout, tidying everythingup the way you want. Cron this job to run every minute or two.

kburger

I agree with everything justsomeone said above, but with a slight modification. Point 4 you can combine with point 1 rather than using a cron. Perform that action whenever somebody visits a page.

But personally, I wouldn't do point 4 at all. Any timestamps that are older than (n) minutes can simply be assumed to be inactive. There's really no need to remove them, is there?

justsomeone

kburger wrote:
But personally, I wouldn't do point 4 at all. Any timestamps that are older than (n) minutes can simply be assumed to be inactive. There's really no need to remove them, is there?

it depends on what you're doing with them.

One case might be where you want to restrict how many people access a particular part of your site at the same time. Say you host an online game/service which has a licence restriction which only 10 people are allowed to play/use at the same time. You might chose/need to use a database field to count how many people are "in". If someone who is "in" neglects to log out, they could be hogging a space. In that case, you might need to run a logout script which searches for expired sessions and removes them from the game/service. This is particularly relevant to third-party services which can't be "trained" to use your own session table.