Log out upon tab/window close

Question

I have an ExpressionEngine application that displays some financial information, and the client is requesting that the user is logged out upon closing a tab/window.

Is that possible?

I currently have the security settings set to both Session and Cookies.

Thanks for the help.

Answer 1

I think this should be the solution, http://api.jquery.com/unload/

After this code executes, the alert will be displayed whenever the browser leaves the current page. It is not possible to cancel the unload event with .preventDefault(). This event is available so that scripts can perform cleanup when the user leaves the page.

$(window).unload(function() {
  alert('Handler for .unload() called.');
});

Obviously you will want to call your logout script rather than the alert, something like:

$(window).unload(function() {
  var logout_path = '{path="logout"}';
  $.get(logout_path);
});

Answer 2

This is a bad idea - explain to your client that it's against the principles of HTTP.

For example, a customer opens different pages of your site in two tabs/windows. The close the second one, and go back to the first tab, but not it's logged out and any link/page submit is going to cause an error. That would piss me right off.

Secondly, Andy's solution is only going to work if the customer has javascript enabled. This may or may not be an issue for you, but it's hardly secure.

Instead you should look at options like a short login timeout (e.g. 10-15 minutes if it's really sensitive data).