Zvonko said:
I don't want to bother bother my visitors. The idea is that when the
user leaves the page to automatically log him off. I want that if the
user hit the Back button on the browser his session is timeouted and he
must login to access the page. Is this possible?
And if you have a web with multiple pages, how to implement the idea
with onunload? It would trigger the logoff even if the user is going to
another page inside the web site, and I don't want that. I would like to
log him off only when he is leaving the site.
Thanks for the answer.
We have this problem too.
Our web server talks to a back end server that is written in a legacy
3GL with a contrived remote call facility which is licensed per session.
It's a monothread language, and the whole setup uses convoluted gobbets
of global data shared between *hundreds* of functions (it's *years*
old), so one web session consumes one back end server session for its
duration.
It's imperative that whenever a user closes their browser or navigates
away that the back end server session is closed down.
They have implemented the front page of the application as a frameset
(shudder!) with one frame in it - the application's login page. The
frameset has an onunload() method which pops up a window using
window.open("logout.jsp"). The logout.jsp closes the back end session
and sends a "window.close()" script to close the popped-up window. All
navigations within the app take place *within* the frame, so the
onunload is not triggered until the browser is closed or a new URL is
entered into the navigation bar.
I know, I know - it's ugly and unreliable (sudden power outages), but
it's what was there when I arrived, I've just tidied it up and made it a
little more reliable than it was.
I have thought of changing the method and implementing some kind of
"heartbeat" using window.setInterval() in every page's "onload" method
(we have a custom tag library which is used to create the page layout
which could do this), and XMLHttpRequest which sends an "I'm still here"
request every 10 seconds or so. The session would then have a
java.util.TimerTask scheduled to close the session down which would be
cancelled and re-scheduled upon receipt of that request.
Either way, it's not *really* supported, and it's going to be a hack.
Good luck, and post back your implemented solution.
Nige