upon session_timeout run script?

efficacious

hello again everyone,

I've just noticed a problem with my login/logout, and my sessions on my website..

Basically The login is fine..

When the user logs in I record the login by updating a column in our database to =1 when they logout I update it to say 0

The problem I'm having is when users don't logout.

If they don't logout via the logout button then the query to the database never gets run...

So my question is how can I say...

if session_timeout run script?

would it work to say onunload=(run my php function?) ??

illzz

Don't have much experience with timeouts, but I'll give my initial thoughts.

What if in addition to (or instead of) marking the logged_in field to 1, indicate the time they logged in. Then have a cron script that will check for users that have been logged in for more than X minutes and log them out. One caveat to this would be if a user is actively logged in for more than X minutes, then they would be logged out automatically.

One way to handle that would be to update the time field at some interval (e.g. on a new page load after 10 minutes). This may increase traffic to the database when comparing the times, but you can probably also store the time in a session variable to cut back on hitting the database only once the predetermined allowed time has elapsed.

Again, I don't have much experience with this, but I thought that I would share an idea.

Ashley_Sheridan

You could store their session ID along with the other information, and then each login can check the session IDs in the database marked as logged in, and check to see if they really are. This might be your only option if you are on a hosting platform that doesn't offer cron jobs.

Weedpacket

Since you can't really tell if the user has left without logging out, or simply not doing anything, you're going to have to make a guess.

Here's one idea:

Set the session timeout to some suitable value: assume that if they've been quiet that long then they must have left.
In php.ini, set the garbage collection probability to 100% (there's a bit of a performance hit with this, but the check has to happen anyway).
Write a custom session handler (see [man]session_set_save_handler[/man]) that runs the "logout" script during garbage collection. You could combine this with Ashley Sheridan's idea and use the database as your session handler.

The downside is that logging out has to wait until the next request that involves sessions hits your server. But, as Sheridan hints, in the absence of cron jobs that's about the only way to get the server to do anything. The upside is that all the session-related stuff is handled by the session manager.

NogDog

If you're going to store something in the DB, it could just be NOW() in a timestamp field. Then instead of checking for a 1/0 to determine if a user is "logged in", check to see if that time is more than x seconds/minutes/hours/whatever in the past.

Ashley_Sheridan

As you're using times to guess that a user has logged out, the system will fail. What you need to do is use their session ID's, and check the ones that you think are still open (i.e. the ones that belong to users who have not hit the logout button) and check each one in turn to see if the server thinks they are still open, as the server will make a much better job at guessing if they are still open.

phpnow

Is there a way to update a particular session? For example:

When a user logs in the sessions is created
then every time the use moves to a new page or activates a new script the php could ID that person by their session and update the session. Then just write some code to close the session if the user is inactive for more then 60 minutes or something like that.

Would that work?