For example, say you have an authed user, but you need them to be authed out after 60 seconds of inactivity. You could use a solution like this:
to detect inactivity. When the inactivity is triggered, AJAX the logout ACTion url (the ACT id for logging out can be different on each install, look it up in your
window.location = "domain.com/you-have-been-logged-out-due-to-inactivity";
This would handle inactivity on the front-end, session invalidation after 60 seconds, and allow a user to resume session on the front-end if they don't change pages but resume their activity before 60 seconds is up (
I finally found my insurance card with my insurance number! Now I can continue filling out my form). It effectively gives the user 60 seconds of inactivity per authed page before being kicked.
Now... don't jump on this without expanding. How security conscious is this application? For example, I could find a way around this to not auth me out after 60 seconds if I needed to, but I'm an experienced developer. And I wouldn't be able to do it on an iPad. I'd need a full desktop browser.
As for CE Cache.. this solution is all async, so as long as you deploy this and refresh all cache, all cached pages will deliver the async code that hits the never-cached ACT url. No problems there.
Disclaimer Don't use that code example. It doesn't handle error or success functions so not actually checking status return, etc.... just a good starting place.
Edit Also, I took a peak at that PYLO add-on... it is just a plugin. If the API for those functions haven't changed, upgrading a plugin from EE2.x to EE3 is really easy. Consider that as an option too. But first review the plugin code and make sure the endpoint methods for log(in-out)/sessions are the same for EE3.