一小时后可靠的自动注销

Question

I have some javascript that is supposed to log you out after an hour but it has some problems, first of all, it doesn't logout you out after an hour, its normally about 20 minutes, and secondly it doesn't always work 100% of the time, say I leave my PC on overnight sometimes I am still logged in (maybe not in the PHP session) and on the same page.

I have a feeling if the screen turns off it pauses the javascript counter.

The code is:

var delay = 3600000;
setTimeout(function(){ window.location =  base_url + 'user/logout' }, delay);

Is there a better more reliable way of doing this? How is it done on banking sites?

EDIT: I don't mean this will actually log out the user, of course that is done server side, I just want the page to automatically redirect to the login page after an hour, just like the banks say "You have been logged out due to inactivity".

This is because there will be sensitive data that I don't want being left on someone's screen overnight

Answer 1

You can attach focus and blur event handlers on the window object to track if the window gets or loses focus.

Also, it's bad idea to logout user after timeout (there can be user activity, ajax requests). Better to check that session is alive at server-side by ajax request and only when it's expired, delete document content and show popup with message about session expiration.