0

We have an MVC 5 based web application.

Part of functionality includes displaying hierarchical structure as a tree (I use this JavaScript component: https://www.jstree.com/)

Tree is displayed in the left part of the screen and is several levels deep. Each level represents different object type. When user clicks on the tree node an AJAX call is made and extended object details are received as a Partial View and displayed on the right part of the screen using jQuery call like this: $('#EventTreeElement').html(data);

Same logic is used to edit/create delete tree nodes.

All of that works as designed, no problems here. Until user logon session expires. When this happens after user selects another tree node application sends back a view for login screen and it is being displayed as a tree element details which is confusing for the end users.

I implemented a quick and easy fix for this where I have a hidden element on login page and before calling $('#EventTreeElement').html(data); I first check if data contains the text for that hidden element. If so I show a dialog that logon session has expired and redirect user to logon page.

However, as most of "quick and easy" fixes this seems more of kludge than a real solution. For example I need to implement the same business logic again in all cases when user clicked "Edit", "Delete" or "Create" buttons for tree elements.

What are "proper" architectural solutions for this?

In one of our other legacy applications each page includes JavaScript code that starts countdown for the duration of user login session. When countdown reaches 0 the popup dialog appears informing that session has expired. I guess I could do something like this but it also seems like a kludge (event though I know some bank websites use the very same approach).

1

It sounds like you need to simply redirect to a login page when expiration occurs, instead of staying on the same page.

Depending on your architecture, you may be able to encode some information in the redirect URL, so that when the user logs in again, they're taken back to the same place they were before the redirection occurred.

0

Session expiration is a hold over from when Session variables would be used to store information server side.

These days the trend is to store per user information in cookies or tokens. Sending it with each request, or processing it client side.

If you adopt this approach you can get rid of the session expiry completely or extend it to days or months before requiring a relogin.

  • 1
    I would assume that, on those sites where a login expires, the security nature of the site precludes the use of cookies to extend login times. – Robert Harvey Aug 21 '17 at 18:57
  • Correct. For security reasons login time should be limited. Extending it to days or months was not the goal. – Joe Schmoe Aug 21 '17 at 19:00
  • 1
    security is a false argument for session expiration. – Ewan Aug 21 '17 at 19:01
  • Maybe. But old habits die hard. We've been doing passwords wrong for the last 30 years, for example. – Robert Harvey Aug 21 '17 at 19:05
  • 3
    "What are "proper" architectural solutions for this?" - dont kick your users out while they are still doing stuff? – Ewan Aug 21 '17 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.