Session timeout warning popup and redirect after timeout expires

We are doing some ASP pages, which is something fairly new to us. I am not the developer that is doing the changes, but was looking around on EE for an answer.

Some sites I visit (like my bank) will pop up a window with something like "your session has expired, click OK to stay logged in". You cou can click OK and it will close the pop up and take you back to the bank's window (and refresh the timeout) or click cancel (or do nothing) and the pop up closes and the main window redirects you to a "you have been logged out" window.

We would like our ASP pages to do the same. We can detect the timeout and when the user clicks on something on our page it does then direct them to the login page.  Our ASP apps also open up different windows to show reports, etc. It would be NICE if when they were timed out we could close all of those and redirect them to a "you have been logged out" page as well.

My ASP developers seem to think having the popup and the redirect (w/o the user doing anything) are hard to do - I am betting it is not that bad.  Help me help them get it "right".  Maybe we just need a Java script include on each ASP page to handle the timeout detection, pop up window, and redirect?  We are runnning on IIS 5 on Windows Server 2000 connected to a SQL server 2000 database.

Thanks!
Dennis
dlwynneAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

peh803Commented:
>>My ASP developers seem to think having the popup and the redirect (w/o the user doing anything) are hard to do

It's not that particularly hard to do ... you just need to set a script timeout value using javascript on your form load event to the equivalent of your session timeout value (iis default is 20 minutes, I think) minus whatever allowable timeframe you want to use to warn your user (i.e., "Your session will time out in 2 minutes", etc.).

I'll get you an example of what I mean for this one shortly...
peh803
0
peh803Commented:
oops, typo...I said this:

"...using javascript on your form load event to..."

Which should have read:

"...using javascript on your **body onload** event to..."
0
peh803Commented:
A good example provided here by GwynforWeb:

click "see solution", or just scroll to the accepted answer:
   http://www.experts-exchange.com/Web/Web_Languages/JavaScript/Q_21066707.html#11605965

Copied / pasted code from the above resource:
<script>
sessionPeriod=2*1000*60 //time in mins 2 mins in this case, use *1000 for secs
strt=new Date()
ended=false
warning=false

function check(){
now=new Date()
if (!warning ){
 if ( now.getTime()-strt.getTime() > sessionPeriod-1 ){
  warning=true
  alert('Session ends in 1 min')
 }
}

if (!ended ){
 if ( now.getTime()-strt.getTime() > sessionPeriod ){
  ended=true
  alert('Session ended')
 }
}
}
setInterval('check()',5000)
</script>

HTH!
peh803
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

dlwynneAuthor Commented:
Looks like a good start, I added

location.replace("http://logged_out_page.asp")

after the alert('Session ended') line


The trouble is the alert box waits forever for the OK to be hit. So if I walk away, I come back to the 1 minute alert, then immediately get the ended alert, then do not get redirected until I OK that one.

Is there any pre-built pop up I can use, or do I need to code a new HTML window on my own?

Thanks!
Dennis
0
peh803Commented:
Yeah, you'll have to use your own custom HTML page for that.  

There are only two built in javascript popup functions:
  "alert()" function - displays message with an "OK" button
  "confirm()" function - displays message with an "OK" and "Cancel" button

If you build your own custom HTML page, you'll be able to put a timer on there that will alert the user, and then, given a reasonable amount of time (30 seconds, or whatever you choose), you can close the window and then redirect the main page to logged_out_page.asp.  Make sense?

One fairly obvious problem with this approach, however, is the problem of popup blockers (xp service pack 2 comes with one built in, and google popup blocker is very common as well).  They'll keep this functionality from working, but they won't block js alert() or confirm().  Just some things to consider...

HTH,
peh803
0
dlwynneAuthor Commented:
They said you can't terminate an ASP session from a Java script.  So I guess we could make it redirect to a "you have been logged out page" than DOES terminate the session?

Dennis
0
peh803Commented:
yes, exactly; that's what you'd have to do.  And they're right, you can't terminate an IIS session from Javascript, specifically because it is a client side language, and the session itself is sitting on the server.  All you can do in JS, as you've stated, is redirect the user's browser after a specified amount of time to another page that will call ASP code to actually terminate the session and log out the user.

HTH,
peh803
0
peh803Commented:
I would caution you that it is ** very ** difficult to maintain state in an ASP / Web application, which it sounds like you're trying to do.  While you can terminate sessions if a user walks away from his / her terminal using the aforementioned methods, things you cannot control that will leave session hanging on the server include the following:
1.) User Closes browser window
2.) User Navigates to another web site by typing the address directly into the address window
3.) User's internet connection dies (for whatever reason)
.....on and on....endless possibilities as to how a state could be left hanging....
This is why MS recommends highly AGAINST increasing the session timeout value (either in IIS or programmatically).

You may already know this, but I figured I should just bring it up.

HTH,
peh803
0
dlwynneAuthor Commented:
OK, we have it mostly working. For now, we abandoned the pop up warning window - if they don't click on something or refresh in xx minutes then we redirect them to the login page and pass a paramter that makes that page terminate the ASP session and show a note -  something like "you have been logged out due to inactivity".

Still have one problem maybe you can help with.  

On some of the screens we open a second report window. If the window is already open we "find" it and re-use it. Well, if the timeout happens we redirect the main window to the login screen but we want to close the report window.  It does not seem to work.

Here is a snippet of the code. Any idea why the report window will not close?  We can put an "alert" pop up right in the code before we try the close and that DOES come up - but the 2nd window remains open.

Thanks!
Dennis


var reportWindow = null;

function openWindow(req,mx,w,h,n,s,r,m) {
  var features = "scrollbars=";
  features += (s != null && s) ? "yes" : "no";
  features += ",resizable=";
  features += (r != null && r) ? "yes" : "no";
  features += ",menubar=";
  features += (m != null && m) ? "yes" : "no";
  features += ",status=yes";
  if (window.screen && navigator.family != "aol") {
    var aw = screen.availWidth - 10;
    var ah = screen.availHeight - 30;
    if (mx) { w = aw - 100;
      h = ah - 100; }
var xc = (aw - w) / 2;
var yc = (ah - h) / 2;
features += ",left=" + xc + ",screenX=" + xc;
features += ",top=" + yc + ",screenY=" + yc; }
features += ",width=" + w + ",height=" + h;
return window.open(req,n,features,true);
}

function openReportWindow(res, showMenu) {
  if (reportWindow == null || reportWindow.closed)
    reportWindow =openWindow("process.html",1,600,400,"actuateReport",1,1,showMenu);
  reportWindow.defaultStatus="Creating Report...";
  reportWindow.focus();
  reportWindow.location.replace(res);
}

function closeReportWindow() {
  if (reportWindow != null) {
   reportWindow.close();
 }
}
0
peh803Commented:
Not sure on this one...I'll look around and see what I can find.
0
dlwynneAuthor Commented:
Turns out that reportWindow is always null when we check it. If we added to to MAKE the window then close it then it works. The downside to this is that if the window is NOT open, it opens and immediately closes it which looks a little strange. We thing the problem is that declaring the window = null at the top is wiping out the actual window pointer so when we test it is reports NULL. When we make a new window, it actually finds the existing window and re-uses it.

Dennis
0
peh803Commented:
Okay, thanks for the info on that.

Anything else you need on this question, or are we through?

Of course, I'm happy to help if there are other questions.

Regards,
peh803
0
peh803Commented:
Glad you were able to find your solution; did you use a different method than what I suggested?

Just curious because of the "B" grade.

Here's a review of the grading guidelines:
  http://www.experts-exchange.com/Web/Web_Languages/ASP/help.jsp#hi73

Thanks for any insight / explanation you might provide.

Regards,
peh803
0
dlwynneAuthor Commented:
Didn't mean to offend, but as I understood it an "A" grade would be for something we could use without any mods or additional code. We did use some of the code in the link you pointed to, plus some code I grabbed elsewhere, and then more code we wrote. Re-reading the help that still seems to apply, but I am new to posing questions on EE - but have been searching and finding answers here for a while. This time I was just too busy to weed through all the answers I found when I did the search for myself and was hoping someone could point me in the right direction - and you did.

Thanks again for the help!
Dennis
0
peh803Commented:
Dennis -- makes sense, and I do indeed think that your grade was appropriate.  

No offense taken.  The only thing is that typically, when anything other than an "A" is given, some explanation accompanies the grade.  In this case, I do agree with you.  My code "helped" push you in the right direction, but you did have to modify it slightly to suit your needs.

Thanks again for using E.E.

Regards,
peh803
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
ASP

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.