4

I have an ExpressionEngine application that displays some financial information, and the client is requesting that the user is logged out upon closing a tab/window.

Is that possible?

I currently have the security settings set to both Session and Cookies.

Thanks for the help.

  • Did any of the answers help you? If yes, please mark the answer correct by clicking on the checkmark to the left of the answer. – Anna_MediaGirl Dec 22 '12 at 6:27
9

I think this should be the solution, http://api.jquery.com/unload/

After this code executes, the alert will be displayed whenever the browser leaves the current page. It is not possible to cancel the unload event with .preventDefault(). This event is available so that scripts can perform cleanup when the user leaves the page.

$(window).unload(function() {
  alert('Handler for .unload() called.');
});

Obviously you will want to call your logout script rather than the alert, something like:

$(window).unload(function() {
  var logout_path = '{path="logout"}';
  $.get(logout_path);
});
| improve this answer | |
  • Just FYI, the only error that might occur here is if EE is set to protect JavaScript, the path variable won't get parsed. I have used Stash to circumvent the parse order and use EE to dynamically build JS. – Justin Kimbrell Nov 27 '12 at 17:22
  • You should be able to simply set a variable on it's own line to get around the protection. I updated the example to show this. – Isaac Raway Nov 27 '12 at 18:07
  • Up vote for cool information and for answering the question asked, but I agree with Adrian that it isn't a good idea in most cases. – UltraBob Nov 28 '12 at 13:50
4

This is a bad idea - explain to your client that it's against the principles of HTTP.

For example, a customer opens different pages of your site in two tabs/windows. The close the second one, and go back to the first tab, but not it's logged out and any link/page submit is going to cause an error. That would piss me right off.

Secondly, Andy's solution is only going to work if the customer has javascript enabled. This may or may not be an issue for you, but it's hardly secure.

Instead you should look at options like a short login timeout (e.g. 10-15 minutes if it's really sensitive data).

| improve this answer | |
  • Good points but I thought they went without saying, give the guy some credit in that a JS function would require JS be enabled to work. I saw his request as a progressive enhancement, the short timeout would be in place regardless. – Andy White Nov 28 '12 at 17:46
  • Also, it doesn't work in FireFox either... so... there's that too... Just a bad idea... – Eric Lamb Oct 26 '13 at 0:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.