Suggestion for a good login+session system?

twhite828

I've been working with PHP for the past 4 months or so in programming class; I'm in my senior year in high school. I've gotten a good (I think, at least) basis in PHP though developing a number of applications for my school's robotics team.

Now that I've done prettymuch everything they'll need for a few years, I'm moving on to my project for second semester: a full browser-based MMORPG. Quite ambitious, in retrospect.

I've spent the past few days writing formulas and functions for the different systems that are going to be involved, but I'm stuck on one crucial part: login.

I need to be able to know who is online, and be able to generate a list so that I can allow player-versus-player fights, and so forth. I also need to make sure a player is logged out when they close their window. The admin panel I wrote for the robotics team (that was login protected) used arrays with usernames/passwords/access levels as opposed to a MySQL database, and did not need a list of people currently using the panel.

If anyone has suggestions on where I should start looking to be able to do this, that would be great.

I've checked out a few avenues, one of which was storing session data (hashes, I believe) serverside in a MySQL database, though in that system I could not ensure a logout when a browser window is closed -- that is, unless I missed some feature of it, which is likely... due to my relative inexperience.

Thanks,
Trevor

laserlight

The basic idea is to assume that if a user has no activity after a period of time, the user is offline. This activity could be a page load, or it could be some kind of client side script that pings the server at suitable intervals.

Krik

Javascript can detect a window close. And with the advent of AJAX I am wondering if you couldn't use that to trigger the log out on window close. Not sure on that never have had a need to use it. If not the javascript could prompt a an alert to make them log out.

Also I seem to remember years ago (prior to pop-up blockers and anit-spyware) running into malicious pop pages that you couldn't close with out opening the windows task manager. So there maybe away to disable the close till they have logged out. Of course that's all hypothetical, I have never had a reason to look into any of it.

laserlight

Krik wrote:
Javascript can detect a window close. And with the advent of AJAX I am wondering if you couldn't use that to trigger the log out on window close.

If indeed Javascript can detect the closure of the browser window, even if the script did not create the window, then that would be feasible. However, there are other problems to consider: what if the user navigates away from the website? What if the user opened two browser windows to the website?

The assumption that no user activity implies a logged out user avoids this problem, though I think that if a client side script is used to ping the server, it would still be possible for the user to go away from the keyboard for some time and yet continue to appear online (it depends on how you implement the script, I suppose). On the other hand, using page loads alone could result in a user browsing a single page on the website to appear offline despite being online.

Krik wrote:
Also I seem to remember years ago (prior to pop-up blockers and anit-spyware) running into malicious pop pages that you couldn't close with out opening the windows task manager. So there maybe away to disable the close till they have logged out.

The problem I see is that if you did manage to do that, then you might end up getting flagged as dangerous by security software, and it could end up irritating users, leading to a poor user experience.

Krik

Yea neither of them were perfect ideas just thought it may get the gears spinning to help him come up with something.

On the user active side of things I did recently get to see someone using one of these "MMORPG" and it forced an inactive log out after not seeing any key strokes (ie. arrow keys and mouse clicks on an object) with in a given time. Maybe advantageous to use an event listener script. Combined that with the server pinging idea.