Asp.net: Implementing Auto-Logout functionality

Question

I have to implement auto-logout functionality in one of my projects and i just cant figure out where to start looking for ideas but SO.

What i need is for the application to redirect the user to the login page if the user session has expired. Please tell me as to what should be my approach to tackle this requirement.

Problem Statement: If the user leaves the system for more than n minutes in any given log-in instance, the system should automatically log them off.

Solution 1

This has been achieved by the following way:

1) Save the time-stamp of every request( server and ajax excluding the session check ajax request) to the server into a session var.

2) Poll the server via a JS function using ajax at frequent intervals and check if the time diff between the session time-stamp and the ajax request time is greater than the session timeout val then log-off the current user and return a bool for that ajax request.

3) Redirect the current page to the login page if the bool returned is true.

Solution 2

Going on the comments as much as the question, I'm not sure if you're after something that will log the user out after a certain time regardless of activity, or just after a period of inactivity.

If you're happy to use the standard ASP.NET mechanisms, this can be done for you without any major work:

Set up your membership provider.

Ensure that your authentication section defines a loginUrl:

<authentication mode="Forms">
  <forms loginUrl="login.aspx" />
</authentication>

You can set a timeout other than the default 30 minutes using the "timeout" attribute on the forms element:

<authentication mode="Forms">
  <forms loginUrl="login.aspx" timeout="15"/>
</authentication>

This will log the user out after 15 minutes of inactivity on your site (either with the browser open with no javascript "heartbeat" or if they spend 15 minutes on another site).

Deny access to anonymous users

<authorization>
  <deny users="?" />
</authorization>

Then ensure that your login, registration and possibly forgotten password pages are accessable to all users using the location Element:

<location path="Logon.aspx">
  <system.web>
    <authorization>
      <allow users="?"/>
    </authorization>
  </system.web>
</location>
<location path="Register.aspx">
  <system.web>
    <authorization>
      <allow users="?"/>
    </authorization>
  </system.web>
</location>
<!-- etc -->

This way, when a user's authentication cookie expires they will be redirected to the URL specified in the loginUrl element of your forms page.

---

If you're not using the standard ASP.NET mechanisms, then you'd probably be better off implementing a "base page" type model.

Create a new class that inherits from System.Web.UI.Page that will check the login state of the user, and if they aren't logged in/timed out then redirect them to your login page.

In you pages that are to be locked down, instead of inheriting from System.Web.UI.Page, you inherit from your base page class (an example of this sort of setup to do something similar - check setting on each page) can be seen in my answer here

---

Your login page will probably need to have some frame busting JS in it to jump back out of the iFrame:

if (top!=self.parent){
  top.location=self.parent.location;
}

---

Or are you saying that by pressing "back" they can still see your pages through the browsers cache? In which case you'll need to be playing around with the Cache headers on every page:

Response.Cache.SetCacheability(HttpCacheability.NoCache);

---

Ok, well, in that case you'll also need a JS timer object to perform a Location.Replace to your login page - have this in a user control on each page (or better yet, in your master page) to automatically redirect the user after n minutes:

<script type="text/javascript">
  setTimeout('location.Replace("/login.aspx")', 900000);
</script>

The time is in milliseconds, so this will move them on in 15 minutes, and no need to get the whole jQuery framework in place just for that.

You might also want to look into the meta refresh tag:

<meta http-equiv="refresh" content="900;url=http://example.com/login.aspx" />

Which will force the browser to refresh to the login page after 15 minutes (this one's in seconds).

Comments

[renegadeMind]

i know Authentication works; hows dat gonna help me? Please understand that the user will not be interacting witht he site and the app will still redirect it to the login page when the session expires! Its gonna be a client side thing!

[Paul Suart]

Perhaps consider re-writing your question to make it clearer to people who are willing to spend time helping you.

[renegadeMind]

well i thought the word auto-logout was self explanatory; guess it isn't!

[renegadeMind]

This is my Prob Statement: If the user leaves the system for more than n minutes in any given log-in instance, the system should automatically log them off. I am sorry if the question asked was not framed correctly.

[Zhaph - Ben Duguid]

If you're using forms authentication, set the timeout attribute to "n" minutes, and their auth token will expire after "n" minutes of inactivity - either a browser window left open, or them wandering off to another site for that time.

[Zhaph - Ben Duguid]

I've added some detail to include the timeout setting, as well as talking about the possibility of modifying the cache headers for the pages.

[renegadeMind]

What i want to do is redirect them to the login page automatically when the session expires on the server side. so its gonna be a combo of the server side and the client side code.

[JoshJordan]

No, not at all :) You have requirements beyond that.

[JoshJordan]

Are you sure? That's generally a dangerous practice. Unless your application is very dynamic, users usually get comfortable perceiving your pages as static. Thus, they feel that their work or the information they are viewing is "safe" independent of their authentication status, and it can be very jarring to have the application throw that away with a timed redirect.

[Martin Smith]

Depending on the nature of the application it can be useful. If it has an intricate form that the user fills in only to discover when they submit it that they are logged out this can be frustrating. I have used the meta refresh tag set to redirect to a page after session expiry that tells the user that they have been logged out. However with the advent of tabbed browsers you need to consider that they might have another active window open for your site in another tab so maybe some sort of ajax call back would be required first.

[Martin Smith]

But with the ajax call back you would need to ensure that it wasn't the call backs themselves keeping the session alive.

[Martin Smith]

You should mark this as the answer then to save people spending time on it

[Zhaph - Ben Duguid]

@Martin: With an intricate form, I'd recommend either a "wizard" style approach (multiple, smaller forms), or a heartbeat to keep the session alive - as you say, nothing will frustrate your users more than spending 20+ minutes filling out a form, and then being told that the site couldn't save it because they've been logged out.