3

So I will be creating a feature to a php application that does the following:

  • Create a session that expires after 30 minutes.
  • After 30 minutes, if there is no user activity in the application (including typing to a textbox, moving a mouse throughout the page), the session will be destroyed and the system will redirect itself to a logout page (logout.php). What I mean by keyboard/mouse is only specific to the system, if the system is open while I am doing other things outside of the system, the system should consider it idol.
  • If the session has moments left to live (E.G. 15 seconds) and there is user activity, the session's life would be extended to another 30 minutes. The reason for this is if a user is inputting a critical information, it would be highly inconvenient to log him/her out just before submitting the form. This is why keyboard and mouse movements should be detected by the system.

I have come up with two possible solutions, but I am not satisfied with them.

First solution

I will almost use javascript for everything.

  • Manage the session or cookie (I am not really sure if javascript recognizes server side sessions)
  • Detect keyboard/mouse activity
  • Extend the life of the session/cookie
  • Redirect to logout.php to destroy the session

I believe this solution is extremely bad. I believe there are ways to manipulate javascript code to change it (to prevent the redirection to logout.php, for example). That is, I am doing a process that should be done in the server.

Second solution

  • use javascript to detect keyboard/mouse activity as before.
  • 15 seconds before 30 minutes, I will have to send an ajax request to a php page. The ajax request contains the information whether there is user activity during this time.
  • Now this particular php page manages the information sent by ajax. If user activity is detected, php just extends the session's life. Otherwise it has to redirect to logout.php either through ajax's .done function or through other means.

I don't think the processes I described above are good solutions. Specifically the heavy use of javascript to do server side things. My problem is I cannot find a way to detect keyboard/mouse movements using php. Everything I found regarding how to do this is by using javascript (understandably since user actions are done in the browser and not in the server).

How should I proceed? What would be the best and most secure solution?

  • Why is it so important for you to detect that the user is still there? – Bogdan Nov 16 '16 at 15:42
  • The client can always claim that the mouse moved, no matter what you're doing. You always have to trust it to not pretend the user is still present. – CodesInChaos Nov 16 '16 at 15:49
  • @Bogdan I was told that was the requirement of the client of this project. – morbidCode Nov 16 '16 at 16:13
  • @morbidCode: in my experience, this sort of requirements are an indication that the client has some problem and thinks this is the solution. Before implementing anything try to find out what the actual problem is. – Bogdan Nov 16 '16 at 19:09
  • Whatever solution you pick, make sure that you handle the fact that users could potentially have multiple browser windows/tabs open... and that the AJAX from one window should not clear the session because there is no activity on THAT window. – Phil M Nov 17 '16 at 18:54
4

Your second solution is best solution. I believe this because it should fundamentally be the clients responsibility to inform the server that they are still active. The server can then do as it must from there.

This gives the server all the control over what happens. The only control the client has is to designate if the user is still active or not. Which is a proper client/server relationship.

  • what about the use of ajax to send the information? It is technically javascript, so the user can still tamper with them right? Just like the first solution, they both use javascript. The only difference is management of sessions goes to the server. But js is still needed to initiate the request. Is that right? Can you explain further how the server gets full control on the second solution? – morbidCode Nov 16 '16 at 16:34
  • When I say "client" that includes the browser. The browser includes all javascript being executed. The first solution, the browser updates cookies, but the browser can't directly update sessions, which means means the browser must send cookies to the server as well... all and all adding more unneeded moving parts to the system. The second solution the client must do only a simple ajax call, and that ajax call is agnostic to what the server does with that information, making the transfer of information less vulnerable. – Sanchke Dellowar Nov 16 '16 at 16:49
  • got it. So my final solution would be this: whenever a user does some keyboard/mouse activity while time is running out, an ajax request would be sent to extend the life of the session by the server. If after 30 minutes no ajax request is received, the server will proceed to destroy the session as normal. I did this so whenever something happens to the less secure ajax request, the server continues normal session destruction as to not directly affect the server if something happens in the client side. What do you think? BTW, am I too concerned with security by avoiding javascript? – morbidCode Nov 16 '16 at 16:57
  • That sounds great. Just always keep these things in mind when writing the code: 1. Can people use this script for an easy ddos? and 2. Am I giving away/proccessing sensitive information without having authentication? – Sanchke Dellowar Nov 16 '16 at 19:20
3

You shouldn't rely on Javascript as the only solution. The PHP should track the session expiration with the Javascript class handling the updates on the page. If no updates from the JS, then the PHP should expire the session automatically on the next request. There are lots of reasons why the JS would not update the page, including computer sleep, network disconnected, and the rare case that the browser has javascript disabled.

The AJAX call would only be something like a a keep-alive request, with the response either being OK, or "what session?".

For solution #1, I wouldn't ping the server for every user action, and if you go that route I would gang up activity and only send a ping every 3-5 minutes (that there was some user activity within the last 3-5 minutes).

Whatever solution you pick, make sure that you handle the fact that users could potentially have multiple browser windows/tabs open... and that the AJAX from one window should not clear the session because there is no activity on THAT window.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.