Log in status and bouncing user to new page if session expired

cretaceous

I have an issue with "log in status" as shown to users.
It's a heavy text entry site and it seems people start typing , go away for an hour and then come back and resume typing and get upset that when they click submit they find they are logged out.

I have to deal with the fact that some of the users seem inexperienced.
There is already an auto save, but there are people who type a long time after they have been logged out.

So.. I have set up an ajax call that runs every few minutes to check the session status and if it's expired the users are bounced to the log in page - the point being they don't get to start re-typing and don't feel they have lost their text.

But of course the ajax call updates the session timeout on session_start - so in fact people stay permanently logged in.

As I see it there's two options:
1) save log in and any page activity time to an item in the db and do all session status time checks against that
or
2) set a time tracker in the session

...so basically write something that ignores built in Session expiry and go to a fixed log out timer that gets updated if they are typing or interacting with the page
(i.e. bypass session.gc_maxlifetime and any associated timers)

I can't see any other way..
Any suggestions?

NogDog

Is there a hard requirement that keeps you from simply increasing the timeout (both for the session cookie and the PHP session storage limit)?

cretaceous

Thanks Nog Dog - tried that - had it set at 2 hours but still had some users complain.
It's a survey via their employer and I guess the users feel irritated already !

I've now added a time into the session - check if inactive for one hour, while updating time on each page refresh or ajax text edit.
At least they will get shown they are logged out before they try to save.
Need to run it a bit more but seems workable.

johanafm

You could implement the session valid check at submit time. That is, when click to submit whatever they have written, you pre-send a session validation check. If they have a valid session, there would be no harm increasing its life time at this point. If there is no valid session, you could present them with an option to log in before you send the actual post data.

cretaceous

Ah yes, good idea! Thanks - that shouldn't be too difficult.