I have an ExpressionEngine application that displays some financial information, and the client is requesting that the user is logged out upon closing a tab/window.

Is that possible?

I currently have the security settings set to both Session and Cookies.

Thanks for the help.

  • Did any of the answers help you? If yes, please mark the answer correct by clicking on the checkmark to the left of the answer.
    – Anna_MediaGirl
    Dec 22 '12 at 6:27

I think this should be the solution, http://api.jquery.com/unload/

After this code executes, the alert will be displayed whenever the browser leaves the current page. It is not possible to cancel the unload event with .preventDefault(). This event is available so that scripts can perform cleanup when the user leaves the page.

$(window).unload(function() {
  alert('Handler for .unload() called.');

Obviously you will want to call your logout script rather than the alert, something like:

$(window).unload(function() {
  var logout_path = '{path="logout"}';
  • Just FYI, the only error that might occur here is if EE is set to protect JavaScript, the path variable won't get parsed. I have used Stash to circumvent the parse order and use EE to dynamically build JS. Nov 27 '12 at 17:22
  • You should be able to simply set a variable on it's own line to get around the protection. I updated the example to show this. Nov 27 '12 at 18:07
  • Up vote for cool information and for answering the question asked, but I agree with Adrian that it isn't a good idea in most cases.
    – UltraBob
    Nov 28 '12 at 13:50

This is a bad idea - explain to your client that it's against the principles of HTTP.

For example, a customer opens different pages of your site in two tabs/windows. The close the second one, and go back to the first tab, but not it's logged out and any link/page submit is going to cause an error. That would piss me right off.

Secondly, Andy's solution is only going to work if the customer has javascript enabled. This may or may not be an issue for you, but it's hardly secure.

Instead you should look at options like a short login timeout (e.g. 10-15 minutes if it's really sensitive data).

  • Good points but I thought they went without saying, give the guy some credit in that a JS function would require JS be enabled to work. I saw his request as a progressive enhancement, the short timeout would be in place regardless.
    – Andy White
    Nov 28 '12 at 17:46
  • Also, it doesn't work in FireFox either... so... there's that too... Just a bad idea...
    – Eric Lamb
    Oct 26 '13 at 0:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.