Session timeout when there is an auto-refresh timer

Support
#1

Hi, I’d like to explain a use case here and have your feedback/advice.
I was able to set up the session timeout mechanism ( that is setting the following parameters in the correct properties files: cuba.userSessionExpirationTimeoutSec; cuba.web.uiHeartbeatIntervalSec; cuba.httpSessionExpirationTimeoutSec) which is working fine for most of the screens, but when I’m on a screen browser with a check box that implements an auto-refresh of the data with a timer, the session timeout does not work.
To me this could be a desired behaviour in certain circumstances but in other since the user is not actually doing anything but is the system that is refreshing automatically the data, it could be required that the session timeout is anyway taking place as well. This in fact, is requested in some application to comply to security rules where in any case the system should logoff a user which is not doing anything for a certain amount of time. Could you please suggest a way to accomplish this?
Many thanks in advance.

#3

Hello @m.colozzi

Thank you for reporting the problem. I’ve filed the issue: GitHub.

Workaround is to replace UI implementation by your own and close all screens and open login screen.

Let’s assume that we have this implementation of UI:

public class MyUI extends AppUI {

    @Override
    public void close() {
        if (app.getConnection().isAuthenticated()) {
            app.removeAllWindows();
            screens.create(webConfig.getLoginScreenId(), OpenMode.ROOT)
                    .show();
        }
        super.close();
    }
}

To replace default implementation put the following entry into web-spring.xml file:

<bean name="cuba_AppUI"
      class="com.company.sample.web.sys.MyUI"
      scope="prototype"/>

Regards,
Daniil

#4

Hi Daniil,
many thanks for your feedback, I think I understood this is to close all windows and ask again the login window which is ok, but my problem is that I don’t know how to manage the event to close, I mean if the automatic timeout is not working then maybe a specific timer should be created, but where to create it ? In the main window? And if that is the right way, do you have also an example for that?

Many thanks.
Massi.

#5

Unfortunately there is no any event in UI when session is expired, so my solution is a workaround without timer or anything else to handle the case.

Moreover the solution with timer has no sense since timer delay should be equal to expiration timeout, so you’ll get the same thing.

#6

Hi Daniil, just to be sure that I explained in the correct way, in attach a page where I report step by step the test case, so the problem is not to show the login page, but that the session timeout actually does not take place when we are in a window with an auto-refresh timer.
Many thanks.
Massi.
Session timeout with auto-refresh timer.pdf (143.3 KB)

#7

Okay, thank you, now it’s clear. In this case session will never expire and it is expected behavior.

So the only way to solve the problem is to declare a timer in the main screen that will be reset and started again.

Could you clarify what version of CUBA do you use?

#8

Hi Daniil, version of CUBA platform is 6.10.11.
If I need to declare a dedicated timer then I need also to detect if the user did anything during the related time interval, how would you suggest to implement that? I would guess that I should detect if he/she moved the mouse or pressed any keys on the keyboard, how to implement that? Do you have an example?
Many thanks.
Massi.

#9

It depends on what behavior is considered as use absence.

As an option you can create singleton JavaScript extension that will track user actions on client-side.