Thread

Hi,

I was wondering if there was a way to sign out the user after he/she has been inactive for a certain period of time, the user could be signed out and redirected to the login page.

Can this be done?

Thanks.

There is a hidden configuration variable for this.

http://ellislab.com/expressionengine/user-guide/general/hidden_configuration_variables.html#user-session-ttl

Quoted from the top of that page.

Hidden configuration variables are placed in system/expressionengine/config/config.php and are used to over-ride default behavior. These are advanced configuration options that should only be used by experienced ExpressionEngine users.

So, you would use something like this.

$config['user_session_ttl'] = 600;

Okay that looks like it can do the job, although I can’t find anything about redirecting the user to a page after he/she gets automatically signed out.

Sorry, I misinterpreted your question, though that config variable will probably be helpful for this issue. 

You will have to expand on your explanation of what you need because I’m not sure I fully understand the behavior you are after. 

Lets say for example that the user is away from the computer with your site up on the browser.  In this example, would you still be redirecting the user, even when the user isn’t in front of the computer?  Or, are you looking to have the user redirect when coming back to the computer and then trying to navigate to another page on your site? 

I’m assuming you are looking for the latter.  So, the flow would have to distinguish between someone who has been logged out due to inactivity and someone who has newly entered the site.  What if the user goes inactive because he is busy doing something else in another tab, closes the whole browser, then comes back to your site the next day?  Would this require different behavior?

Please expand on your explanation.  😉

Sorry about that, I will expand on my question.

For safety issues and avoiding errors, whenever the user is away from the computer or has not had any activity on the particular website for a certain amount of time, the user will need to be signed out and redirected to the login page. This should be done automatically and not when a user clicks on something.

Correct, when the user is redirected to the login page after being logged out due to inactivity, once the user logs back in, the user will be redirected to where ever they were before being logged out.

If a user closes the browser and comes back to the website the next day, the user should be automatically logged out on the closing of the browser.

Even if the user is busy in another tab, the user should still be logged out due to inactivity, when the user logs back in, he/she will be sent to where the user was at previously.

Please don’t hesitate to ask further questions, if some parts don’t make sense.

Thanks.

Thanks for expanding, I think I have it now.  One method to accomplish this is to force an automatic browser refresh via JS at the intervals you have set for inactivity.  If the user is in another tab or leaves the browser, then the JS browser refresh is the only way to force actions on the browser.  If you wanted to get fancy, then perhaps you could first check the “last active” timestamp of the user and then auto refresh only if that timestamp is older than your set interval for logging out the user.  That would save the user from having to deal with unnecessary refreshes.

I’m not sure off the top of my head about closing the browser.  I don’t think there is a method which will force a log-out on closing the browser Perhaps the cookie expiration would be good enough for this?

Ya that sounds like it could work. Do you have any sources to point me to for the JS? I am not sure how I could come about creating this.

I am not too worried about closing the browser log out for now.

Thanks.