?
Solved

Session timeout warning popup and redirect after timeout expires

Posted on 2004-11-16
15
Medium Priority
?
2,905 Views
Last Modified: 2008-01-09
We are doing some ASP pages, which is something fairly new to us. I am not the developer that is doing the changes, but was looking around on EE for an answer.

Some sites I visit (like my bank) will pop up a window with something like "your session has expired, click OK to stay logged in". You cou can click OK and it will close the pop up and take you back to the bank's window (and refresh the timeout) or click cancel (or do nothing) and the pop up closes and the main window redirects you to a "you have been logged out" window.

We would like our ASP pages to do the same. We can detect the timeout and when the user clicks on something on our page it does then direct them to the login page.  Our ASP apps also open up different windows to show reports, etc. It would be NICE if when they were timed out we could close all of those and redirect them to a "you have been logged out" page as well.

My ASP developers seem to think having the popup and the redirect (w/o the user doing anything) are hard to do - I am betting it is not that bad.  Help me help them get it "right".  Maybe we just need a Java script include on each ASP page to handle the timeout detection, pop up window, and redirect?  We are runnning on IIS 5 on Windows Server 2000 connected to a SQL server 2000 database.

Thanks!
Dennis
0
Comment
Question by:dlwynne
  • 10
  • 5
15 Comments
 
LVL 19

Expert Comment

by:peh803
ID: 12595143
>>My ASP developers seem to think having the popup and the redirect (w/o the user doing anything) are hard to do

It's not that particularly hard to do ... you just need to set a script timeout value using javascript on your form load event to the equivalent of your session timeout value (iis default is 20 minutes, I think) minus whatever allowable timeframe you want to use to warn your user (i.e., "Your session will time out in 2 minutes", etc.).

I'll get you an example of what I mean for this one shortly...
peh803
0
 
LVL 19

Expert Comment

by:peh803
ID: 12595151
oops, typo...I said this:

"...using javascript on your form load event to..."

Which should have read:

"...using javascript on your **body onload** event to..."
0
 
LVL 19

Accepted Solution

by:
peh803 earned 750 total points
ID: 12595190
A good example provided here by GwynforWeb:

click "see solution", or just scroll to the accepted answer:
   http://www.experts-exchange.com/Web/Web_Languages/JavaScript/Q_21066707.html#11605965

Copied / pasted code from the above resource:
<script>
sessionPeriod=2*1000*60 //time in mins 2 mins in this case, use *1000 for secs
strt=new Date()
ended=false
warning=false

function check(){
now=new Date()
if (!warning ){
 if ( now.getTime()-strt.getTime() > sessionPeriod-1 ){
  warning=true
  alert('Session ends in 1 min')
 }
}

if (!ended ){
 if ( now.getTime()-strt.getTime() > sessionPeriod ){
  ended=true
  alert('Session ended')
 }
}
}
setInterval('check()',5000)
</script>

HTH!
peh803
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:dlwynne
ID: 12597946
Looks like a good start, I added

location.replace("http://logged_out_page.asp")

after the alert('Session ended') line


The trouble is the alert box waits forever for the OK to be hit. So if I walk away, I come back to the 1 minute alert, then immediately get the ended alert, then do not get redirected until I OK that one.

Is there any pre-built pop up I can use, or do I need to code a new HTML window on my own?

Thanks!
Dennis
0
 
LVL 19

Expert Comment

by:peh803
ID: 12598021
Yeah, you'll have to use your own custom HTML page for that.  

There are only two built in javascript popup functions:
  "alert()" function - displays message with an "OK" button
  "confirm()" function - displays message with an "OK" and "Cancel" button

If you build your own custom HTML page, you'll be able to put a timer on there that will alert the user, and then, given a reasonable amount of time (30 seconds, or whatever you choose), you can close the window and then redirect the main page to logged_out_page.asp.  Make sense?

One fairly obvious problem with this approach, however, is the problem of popup blockers (xp service pack 2 comes with one built in, and google popup blocker is very common as well).  They'll keep this functionality from working, but they won't block js alert() or confirm().  Just some things to consider...

HTH,
peh803
0
 

Author Comment

by:dlwynne
ID: 12605257
They said you can't terminate an ASP session from a Java script.  So I guess we could make it redirect to a "you have been logged out page" than DOES terminate the session?

Dennis
0
 
LVL 19

Expert Comment

by:peh803
ID: 12605382
yes, exactly; that's what you'd have to do.  And they're right, you can't terminate an IIS session from Javascript, specifically because it is a client side language, and the session itself is sitting on the server.  All you can do in JS, as you've stated, is redirect the user's browser after a specified amount of time to another page that will call ASP code to actually terminate the session and log out the user.

HTH,
peh803
0
 
LVL 19

Expert Comment

by:peh803
ID: 12605443
I would caution you that it is ** very ** difficult to maintain state in an ASP / Web application, which it sounds like you're trying to do.  While you can terminate sessions if a user walks away from his / her terminal using the aforementioned methods, things you cannot control that will leave session hanging on the server include the following:
1.) User Closes browser window
2.) User Navigates to another web site by typing the address directly into the address window
3.) User's internet connection dies (for whatever reason)
.....on and on....endless possibilities as to how a state could be left hanging....
This is why MS recommends highly AGAINST increasing the session timeout value (either in IIS or programmatically).

You may already know this, but I figured I should just bring it up.

HTH,
peh803
0
 

Author Comment

by:dlwynne
ID: 12616501
OK, we have it mostly working. For now, we abandoned the pop up warning window - if they don't click on something or refresh in xx minutes then we redirect them to the login page and pass a paramter that makes that page terminate the ASP session and show a note -  something like "you have been logged out due to inactivity".

Still have one problem maybe you can help with.  

On some of the screens we open a second report window. If the window is already open we "find" it and re-use it. Well, if the timeout happens we redirect the main window to the login screen but we want to close the report window.  It does not seem to work.

Here is a snippet of the code. Any idea why the report window will not close?  We can put an "alert" pop up right in the code before we try the close and that DOES come up - but the 2nd window remains open.

Thanks!
Dennis


var reportWindow = null;

function openWindow(req,mx,w,h,n,s,r,m) {
  var features = "scrollbars=";
  features += (s != null && s) ? "yes" : "no";
  features += ",resizable=";
  features += (r != null && r) ? "yes" : "no";
  features += ",menubar=";
  features += (m != null && m) ? "yes" : "no";
  features += ",status=yes";
  if (window.screen && navigator.family != "aol") {
    var aw = screen.availWidth - 10;
    var ah = screen.availHeight - 30;
    if (mx) { w = aw - 100;
      h = ah - 100; }
var xc = (aw - w) / 2;
var yc = (ah - h) / 2;
features += ",left=" + xc + ",screenX=" + xc;
features += ",top=" + yc + ",screenY=" + yc; }
features += ",width=" + w + ",height=" + h;
return window.open(req,n,features,true);
}

function openReportWindow(res, showMenu) {
  if (reportWindow == null || reportWindow.closed)
    reportWindow =openWindow("process.html",1,600,400,"actuateReport",1,1,showMenu);
  reportWindow.defaultStatus="Creating Report...";
  reportWindow.focus();
  reportWindow.location.replace(res);
}

function closeReportWindow() {
  if (reportWindow != null) {
   reportWindow.close();
 }
}
0
 
LVL 19

Expert Comment

by:peh803
ID: 12618393
Not sure on this one...I'll look around and see what I can find.
0
 

Author Comment

by:dlwynne
ID: 12625695
Turns out that reportWindow is always null when we check it. If we added to to MAKE the window then close it then it works. The downside to this is that if the window is NOT open, it opens and immediately closes it which looks a little strange. We thing the problem is that declaring the window = null at the top is wiping out the actual window pointer so when we test it is reports NULL. When we make a new window, it actually finds the existing window and re-uses it.

Dennis
0
 
LVL 19

Expert Comment

by:peh803
ID: 12625793
Okay, thanks for the info on that.

Anything else you need on this question, or are we through?

Of course, I'm happy to help if there are other questions.

Regards,
peh803
0
 
LVL 19

Expert Comment

by:peh803
ID: 12626431
Glad you were able to find your solution; did you use a different method than what I suggested?

Just curious because of the "B" grade.

Here's a review of the grading guidelines:
  http://www.experts-exchange.com/Web/Web_Languages/ASP/help.jsp#hi73

Thanks for any insight / explanation you might provide.

Regards,
peh803
0
 

Author Comment

by:dlwynne
ID: 12626505
Didn't mean to offend, but as I understood it an "A" grade would be for something we could use without any mods or additional code. We did use some of the code in the link you pointed to, plus some code I grabbed elsewhere, and then more code we wrote. Re-reading the help that still seems to apply, but I am new to posing questions on EE - but have been searching and finding answers here for a while. This time I was just too busy to weed through all the answers I found when I did the search for myself and was hoping someone could point me in the right direction - and you did.

Thanks again for the help!
Dennis
0
 
LVL 19

Expert Comment

by:peh803
ID: 12626538
Dennis -- makes sense, and I do indeed think that your grade was appropriate.  

No offense taken.  The only thing is that typically, when anything other than an "A" is given, some explanation accompanies the grade.  In this case, I do agree with you.  My code "helped" push you in the right direction, but you did have to modify it slightly to suit your needs.

Thanks again for using E.E.

Regards,
peh803
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I recently decide that I needed a way to make my pages scream on the net.   While searching around how I can accomplish this I stumbled across a great article that stated "minimize the server requests." I got to thinking, hey, I use more than one…
I was asked about the differences between classic ASP and ASP.NET, so let me put them down here, for reference: Let's make the introductions... Classic ASP was launched by Microsoft in 1998 and dynamically generate web pages upon user interact…
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …
Is your OST file inaccessible, Need to transfer OST file from one computer to another? Want to convert OST file to PST? If the answer to any of the above question is yes, then look no further. With the help of Stellar OST to PST Converter, you can e…

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question