Log off user after period of inactivity?

[Techno]

Hi.
I am using my own custom code to create users, log them in etc... but using Forms authentication.

I need the ability to "automatically" logoff a user. There is a process that occurs when the user is "logged off".

Now, when the user logs in, the user object is held in session.

The user can logoff via the site, or when the forms authentication times out, the user is logged off by obtaining the user object in session.

However, if the browser is closed then how can I detect a period of inactivity so then i will have the ability to log off the user?

Javascript/AJAX solutions are not permitted

[sapator]

You may try to do something when the browser is closing:
http://www.codeproject.com/Tips/1548...browser-closed
If i am not mistaken the log process of asp will work with an authentication cookie on the client and a session id on the server.So you may be wanting to use something like when user opens the browser (i take it that you don't want to clear the session as shown above when user exit browser) you get it's security cookie and combine it to the session id to see if it has been expired.That is just a thought,how to do that didn't occur to me in an application so i don't know.
There is also a thought to use the sql server.P.E. asp database has a,errr, user last login or something similar(not in a asp.net db now) so you may use something similar and automatically allow user access if the expiry time hasn't passed.Of course you need to know the id of the user that was in and i can't think anything rather than the security cookie to get that.

[Techno]

yeh again - no javascript is permitted for this solution

[danasegarane]

As you said No script allowed then you could use the below logic

1. Add meta tag that reloads the page every x seconds , for example 5 seconds in example

<META HTTP-EQUIV="REFRESH" CONTENT="5">

2. Then check the value for the session value for user session

3. Or handle the Session_End method of the Global.asax file

[Techno]

cant do that either. do not want the page to refresh

[danasegarane]

And here is the another option. Use a Frame in your we page with width=0 so that this could be hidden. Create a simple web page that check for the user session at the server side. Load the Frame with this page and reload the sub page every x seconds. If session is logged out use the Response.Redirect to Logout page

[Techno]

not a good solution im afraid. Frames no go go go go go......

The only other option here is to run a SQL job every day to see which users do not have a LoggedOut value set in the field then set it to LoggedIn + x mins. this is the more preferred approach but isnt accurate in terms of when the user has actually stopped using the site.

[danasegarane]

not a good solution im afraid. Frames no go go go go go......

The only other option here is to run a SQL job every day to see which users do not have a LoggedOut value set in the field then set it to LoggedIn + x mins. this is the more preferred approach but isnt accurate in terms of when the user has actually stopped using the site.

How could you call the SQL method without reloading the page. You say No script allowed . What about Jquery ?

[Techno]

I meant as in no front end javascript (JQuery is javascript)

[sapator]

Out of curiosity, why JavaScript is not allowed.What big scientific brain suggested that?Jquery is slowly becoming more important than asp.net itself.
Also if you are going to use something similar to the user last login method why haven't you used the default asp.net database in the first place?
I'm not judging you but clearly someone on your stuff had a pack of beers too many that day.

[Techno]

Its requirements my friend. client requirements.
I am of course using SQL Server database for memberships etc... but because of the requirements, you cannot just say "but we MUST use this", you have to comply.

furthermore, scripts maybe disabled as part of network policy for the browser. you must make it work without any javascript to have a solid foundation for a site to work under any circumstances.

[jdogg]

I know that session variable has a default time of like 20 minutes to keep data stored, this can be changed however to what you like. It should be possible to use this since your keeping their log in information in a session variable. so when the time it expires, session is cleared and they should be logged out, but i am not sure if that is the correct purpose of session timeout function. I have not used it much but it should work, may have to add some code for it. So you can try using the Timeout property something like Session.Timeout = 5 this will set it to 5 miuntes which is not long, but just play around with that and it should do the trick

[Techno]

i am aware of how session works but this is not quite what I was asking for

thanks anyway

[jdogg]

Oh sorry, I was not trying to imply you didn't know lol just offering a suggestion. Also since your reply I went back to reread what you were asking, for some reason I didn't read all your original post. I am not sure how I misread what you were looking for, I didn't see how the user was logging off and that you were asking for checking inactivity of the browser

[sapator]

So if you cannot use anything that relates to asp.net why don't you persuade them to make it to winforms network related?It's like asking you to make a win driver without using a low level language(well sort of but you get the idea).

[Techno]

how do you mean winforms network related? Its meant to be a public facing website....

the only solution here is to make a SQL Server job which runs every night and updates the logoff time where it is NULL

[sapator]

You said network policy so i thought it was on a company network or something.If it is a public web site then ignore.

[szlamany]

Hi.
There is a process that occurs when the user is "logged off".

That is a really vague statement - a process where? How - when - in SQL - in the code behind? Does it need to run on this timeout?

Showing some code would help us get into the "mindset" you are trying to describe...

Now, when the user logs in, the user object is held in session.

If you want to control this "object" then hold it outside of SESSION - so you can kill it from SQL. Session can talk to this "object" and this object can be killed outside of ASP.Net. Seems you might be relying on SESSION timeout for normal kill activity but also want to leverage your own kill activity on top of that - then abstract it - right?

However, if the browser is closed then how can I detect a period of inactivity so then i will have the ability to log off the user?

Since there is no STATE how can the server know about the client - the client might or might not still be there - stateless means you simply don't know.

[sapator]

Since there is no STATE how can the server know about the client - the client might or might not still be there - stateless means you simply don't know.

I just thought of something that i do with WMI in winforms.Doable or not here, i don't know.Suppose you set some js that works as a timer and give the id of the logged in user to a webservice in a finite amount of time.The service will hit the sql when it gets the credential and will force an update to the isonline column.So here is your period of inactivity.Of course you need an sql job later to do whatever is that you want to do when user is not online.
Ohhh,ye you said not javascript....Errrr,mmm...Mmm.An asp timer,eeer, and then you said no refresh....Ok this is kinda pointless.
Ok now i'm curious.What exactly does this page will do and since you are not using javascript EVERY SINGLE CLICK ON EVERYTHING WILL DO A REFRESH!How will you handle the non refresh part?Or else your page will just sit there and look at you with a smile and you will smile back and she will smile again etc.....Now,why do i have the urge for a beer?