How does one enforce automatic logout due to inactivity in a Django application?

Question

In my Django application, I would like for the user to be automatically logged out after 30 minutes of inactivity, so I used this setting in settings.py:

SESSION_COOKIE_AGE = 1800

However, using this setting logs the user out in 30 minutes regardless of activity. How does one enforce automatic logout due to inactivity in a Django application?

Possible duplicate of [Logging users out of a Django site after N minutes of inactivity](http://stackoverflow.com/questions/2539109/logging-users-out-of-a-django-site-after-n-minutes-of-inactivity) — Andrés Pérez-Albela H., Oct 22 '15 at 06:43

Fynn Becker · Answer 1 · 2019-01-23T16:17:41.240

5

As an update on this topic. Django now has the SESSION_SAVE_EVERY_REQUEST setting which makes it a lot easier.

edited Jan 23 '19 at 16:17

answered Mar 14 '16 at 12:57

Fynn Becker

1,278
2
18
21

score 4 · Answer 2 · edited May 19 '12 at 08:22

django-session-security notes the user activity based on server side and javascript events such as mousemove, keypress, etc, etc ... Also, it warns the user before expiring the session, and tries not to expire the session (where there any activity maybe from another browser tab ?).

Just install it and set settings.SESSION_SECURITY_EXPIRE_AFTER=1800. You could also set settings.SESSION_SECURITY_WARN_AFTER=1740.

okm · Accepted Answer · 2012-04-22T05:19:56.907

3

You could update the session of an user when he accesses your site. For example in a middleware, this force session to be set again.

class ActivateUser(object):
    def process_request(self, request):
        if request.user.is_authenticated():
            request.session.modified = True

edited Apr 22 '12 at 05:19

answered Apr 22 '12 at 05:12

okm

23,575
5
83
90

3

This makes update to DB on every request. Could affect performence. – Tomasz Wysocki Apr 22 '12 at 09:53
1

@TomaszWysocki considering use cache backend or [redis backend](https://github.com/liokm/django-redisession) then – okm Apr 22 '12 at 10:29
1

Thanks! Right, it makes a db request every time, but it works. Premature optimization aside, it's reliable :) – dangerChihuahua007 Apr 23 '12 at 16:47

How does one enforce automatic logout due to inactivity in a Django application?

3 Answers3