Automagically or force logout after 60 seconds

Question

I have an EE3x site that is running User, Cartthrob, Transcribe, CE Cache (there is a lot going on) and I need a way to be able to automagically log-out users after 60 seconds of inactivity.

The issue is, this company uses tablets in their offices to allow (and assist) their patients to shop (like a kiosk, but it is not an app). And we have a security issue if the customer does not remember to log out.

Any ideas on how we can achieve this? I've looked at trying to force logout either with User or Cartthrob, but neither of those seem to have that feature either.

I've tried using sessions, but I have another issue there - the user gets logged out after visiting more than 1 other URL (does not seem to store sessions, or maybe a CE Cache conflict?).

This really is exactly what I'm looking for, but it is only for up to EE2x :/ https://www.putyourlightson.net/logmein/docs has a simple {exp:logmein:logout} tag to place in a template.

Answer 1

I have a thought. Really, security of session lives server side. Assuming you are allowed to have JavaScript functioning in your browser, why not let it handle timing and let the backend handle session validation?

For example, say you have an authed user, but you need them to be authed out after 60 seconds of inactivity. You could use a solution like this:

https://stackoverflow.com/questions/667555/detecting-idle-time-in-javascript-elegantly

to detect inactivity. When the inactivity is triggered, AJAX the logout ACTion url (the ACT id for logging out can be different on each install, look it up in your exp_actions table):

$.ajax({
    url: "domain.com/index.php?ACT=3",
}).done(function() {
    window.location = "domain.com/you-have-been-logged-out-due-to-inactivity";
});

This would handle inactivity on the front-end, session invalidation after 60 seconds, and allow a user to resume session on the front-end if they don't change pages but resume their activity before 60 seconds is up (I finally found my insurance card with my insurance number! Now I can continue filling out my form). It effectively gives the user 60 seconds of inactivity per authed page before being kicked.

Now... don't jump on this without expanding. How security conscious is this application? For example, I could find a way around this to not auth me out after 60 seconds if I needed to, but I'm an experienced developer. And I wouldn't be able to do it on an iPad. I'd need a full desktop browser.

As for CE Cache.. this solution is all async, so as long as you deploy this and refresh all cache, all cached pages will deliver the async code that hits the never-cached ACT url. No problems there.

Disclaimer Don't use that code example. It doesn't handle error or success functions so not actually checking status return, etc.... just a good starting place.

Edit Also, I took a peak at that PYLO add-on... it is just a plugin. If the API for those functions haven't changed, upgrading a plugin from EE2.x to EE3 is really easy. Consider that as an option too. But first review the plugin code and make sure the endpoint methods for log(in-out)/sessions are the same for EE3.