So I will be creating a feature to a php application that does the following:
- Create a session that expires after 30 minutes.
- After 30 minutes, if there is no user activity in the application (including typing to a textbox, moving a mouse throughout the page), the session will be destroyed and the system will redirect itself to a logout page (logout.php). What I mean by keyboard/mouse is only specific to the system, if the system is open while I am doing other things outside of the system, the system should consider it idol.
- If the session has moments left to live (E.G. 15 seconds) and there is user activity, the session's life would be extended to another 30 minutes. The reason for this is if a user is inputting a critical information, it would be highly inconvenient to log him/her out just before submitting the form. This is why keyboard and mouse movements should be detected by the system.
I have come up with two possible solutions, but I am not satisfied with them.
- Detect keyboard/mouse activity
- Extend the life of the session/cookie
- Redirect to logout.php to destroy the session
- 15 seconds before 30 minutes, I will have to send an ajax request to a php page. The ajax request contains the information whether there is user activity during this time.
- Now this particular php page manages the information sent by ajax. If user activity is detected, php just extends the session's life. Otherwise it has to redirect to logout.php either through ajax's .done function or through other means.
How should I proceed? What would be the best and most secure solution?