sessions

[chrisleon]

If you are on a bank's website and you sit idle for more than 30 minutes, somehow they can expire your session and return you to the login page. Is this an easy task in php?

[Threehearts]

yes and no. 🙂
everything about that issue is to be found in depth and width in the php manual http://www.php.net/manual/en/ref.session.php

all you need to do is save your session data in a database, write a timestamp for every action and deleted all sessionids with a timestamp older than 30 mins.

ok, its a blittle bit more complicated, but details are in the manual 🙂

jakob

[chrisleon]

I am currently doing that with every page requested (writing a timestamp) and I have a cron job sweeping through and determining inactivity so I can reset it to NULL. But if the user is still on the page, they can start navigating from there current position. I would like a way to send them to a different page if I encounter there session timeout.

[Threehearts]

hm.

The problem here is that http/https is a pull based technology, so you cant push anything to the browser unless you use a java app or something similar.

So unless you get a request by the browser you basically can do nothing, but I thats pretty obvious.

Just so it is mentioned - you can do stuff like that with Flash - which you can generate with php as well.
But if you want to stick to plain http/https I would create a micro frame somewhere in which I would have a website reloading every 10, 20 whatever seconds.

If the database says idle time too long -> redirect to page of choice, or deactivate navigation or whatever.

Would work with an applet as well of course.

Severaly more or less amoraly variances of this theme are thinkable...

hope this helps.
jakob

[chrisleon]

If the session_cache_expire is set to 30 and the user tries to click something on the site and it has passed its 30 minute expire, can you redirect to a different page?

[Threehearts]

only if you controlled what happens when someone clicks in the first place.
so what you need to establish is a dynamic control element that generally determines what will happen as soon as the click (or other interaction) has occurred.

This is not so easy since you dont want that to happen after the request to the server has been sent but before - after all you want to control navigation after the server has determined that the session has expired but before the user has set activity, at least I understood it that way.

So I see 3 "established" possibities, unless you accept that you have to wait for the clients next request to block him. (So he get logged after 30 mins inactivity but gets that information only when he tries to continue the session)

1) navigation = java applet
with an applet you can establish a persistent connection and have the possibility to "push" the information to the client
2) naviagtion = flash
same thing - persistent connection possible, therefor "push" possible
3) active control via clientsided scripts (dynamic link generation for example) including the aforementioned reload thingy

mind that 3) is propably easiest (IMHO) to do but you will want to consider some security issues when going this way.

I would not claim that these are all or even the best ways...
Just the things that I'm thinking of atm.

jakob

[EDIT]
hrmpf. high time to leave office
yes it is.

if($answer_from_db == true && $color_of_sky == 'shiny'){
//put out requested content
}elseif($answer_from_db == true && $color_of_sky == 'not shiny'){
// put out other content
}else{
// and now something completely different
}

hope this is a better answer to your question
[/EDIT]

[Threehearts]

Good morning.

After thinking about it I feel my answer was somewhat lacking.
Sorry for that.
Here is what you have to do to establish verifyable navigation in the first place:
(my variant of it at least)

navigation:

<script language='javascript'>
   function func_on_click(arg_calling_obj){
      // use id of calling button to know what content to call
      // permutations possible using string operations.
      str_requested_content = arg_calling_obj.id;

  // put the value into a form
  document.forms[0].elements[0].value = arg_calling_obj;

  // and send the form to the server
  document.forms[0].submit();

  // whats practical with this method is that you can send all kinds of information
  // to the server at the same time... options, decision chains whatever
   }
</script>
<div id="buttonForRequestedContent" onmouseup="func_on_click(this);">

content:

<form method='post' id='form_transmission'>
</form>

[Threehearts]

Good morning.

After thinking about it I feel my answer was somewhat lacking.
Sorry for that.
Here is what you have to do to establish verifyable navigation in the first place:
(my variant of it at least)

navigation:

<script language='javascript'>
   function func_on_click(arg_calling_obj){
      // use id of calling button to know what content to call
      // permutations possible using string operations.
      str_requested_content = arg_calling_obj.id;

  // put the value into a form
  document.forms[0].elements[0].value = arg_calling_obj;

  // and send the form to the server
  document.forms[0].submit();

  // whats practical with this method is that you can send all kinds of information
  // to the server at the same time... options, decision chains whatever
   }
</script>
<div id="buttonForRequestedContent" onmouseup="func_on_click(this);">

content - before sending:

<form method='post' id='form_transmission'>
    <input type='hidden' name='formelement_navigation' value='<?= $var_current_content ?>'>
</form>

content - after sending:

<?php
     // simplest form of getting content is including it directly.
     $var_requested_content = $_POST[formelement_navigation];

 // verify if user is entitled to see content
 // do other analytical stuff with info sent in the form
 // before including content test whether the values sent by the form is valid
 // and of course test whether the content is ok - well formed, whatever

include($var_requested_content );

// obviously instead of including a file you could generate something from
// a database or xml/xsl stuff... you can do about anything at this point.
?>

well.
I hope this finally is something that you can work with.

jakob

[Weedpacket]

Or you could set the probability that sessions are garbage-collected to 100%, and their maximum lifetime to 30 minutes. If you want added defence, look at the session's modification time (either the file itself or an added timestamp variable) to see if that's more than 30 minutes in the past.

However you do it; if a page request comes in and the session is nonexistent (because it was gc'd) or too old (however you determine that), don't process the script any further, but "header('Location:login.php'); exit();" instead.

This doesn't require Javascript, and certainly doesn't require passing information to the browser to see if it comes back (which isn't a good idea, because you can't trust what comes back).

If you want the page to redirect itself - client-side - then of course you need Javascript. For that, an onLoad() handler that starts a 30-minute timer would be adequate. When the timer expires, it changes the page location to the login page. The login page would then be written to automatically log out anyone visiting it, destroying the session. But you would still need the server to watch for timeouts because you can never trust the client to do anything.