3

I have a nice Logout button on the menu of my PHP app, but some people don't use it, they just quit the browser.

Is there any way that I can detect this (I realize that it won't handle browser crash, but it's better than I have now & covers 99% of cases).

This will be my first piece of JS.

  • I presume that I can easily write a page close handler? Or should I use onbeforeunload()?
  • In it, maybe I can walk all browser windows and their tabs (same or different for each browser? (IE, FF, etc))
  • I can get the URL of each tab and check if it is running my app (or is there a better way to do it)?
  • If this is the last tab, either load a new age which is my app’s logout page, then close it (waiting for it to fully open? Or just send an HTTP request and wait for 200 OK), or maybe some Ajax?

Update

No timer based solutions, please. I have one in place, but a single user set the timeout to 999999 minutes and the number of simultaneous users to 1, then closed his browser & locked himself out

Update

It seems that those here who know say that it can't be done in JS, and Google suggests to me that is isn't supported in the DOM.

But, what about another way? Think laterally, folks. Can I push a cookie when the user opens a new tab with a page from my app? And then remove the cookie when the user wishes to close the tab? And check if I am remvoing the last cookie & inform the server to treat this as logout?

If not cookies is there some other method? (Use Ajax on page open & close and the server can decide if the last tab has closed?)

halfer
  • 19,824
  • 17
  • 99
  • 186
Mawg says reinstate Monica
  • 38,334
  • 103
  • 306
  • 551

3 Answers3

3

Just timeout a session on the server side if no requests have been made under it in the last 'x' seconds/minutes.

Doing this via JS could be as simple as sending a periodic "heartbeat" request back to the server once every 5 seconds, which stops when the tab is closed. Then, if your logout timeout is 5 minutes, then if it doesn't get a heartbeat for 5 minutes, you can be as confident as is possible that the client is gone.

This is useful if, for example, you have pages with a ton of content (say a long article) where the user will not be making any requests for several minutes/hours, but doesn't close the tab, and as such, you want them to keep an active session.

jefflunt
  • 33,527
  • 7
  • 88
  • 126
  • 1
    Well, that's not a problem, because their machine is idle (they are away) and thus for security reasons you need to expire their session. If someone else came back to the machine and woke it up, you wouldn't want that other person to have access to the original user's session without re-entering the user's password. Finally, if a machine goes to sleep, there is absolutely no way to know that, because from your server there's no distinction between that and a shutdown/reboot/network disconnect/power outage. The **only** indication you get are requests being made from the client - that's it. – jefflunt Oct 16 '11 at 02:27
  • True, I hadn't thought of that. – icktoofay Oct 16 '11 at 02:28
1
  1. You can add some code that gets executed when a page is closed in onbeforeunload. Browsers may abort your code, though, if it takes too long.
  2. No, you cannot iterate through tabs; that would be a security hole.
  3. No; since you cannot iterate through tabs, you cannot get their URLs either.
  4. You cannot detect if it's the last tab with your page open, but if you could, a browser would likely block opening a window on closing a tab. A synchronous AJAX request may work, however.
icktoofay
  • 126,289
  • 21
  • 250
  • 231
  • As I said, I am a JS n0b, but are you *certain* when you say "you cannot iterate through tabs"? Jus google for "delete duplicate tabs" and you will find quite a few browser pligins. How are they doing it? – Mawg says reinstate Monica Oct 17 '11 at 02:25
  • 2
    @Mawg: Those are browser extensions. You're not writing a browser extension; you're writing a web page. Extensions can do more things than web pages. – icktoofay Oct 17 '11 at 03:16
1

There is no definitive way to do what you're asking, in fact this has been asked before here:

javascript detect browser close tab/close browser

Use a session timeout, like the first comment suggested.

Community
  • 1
  • 1
b01
  • 4,076
  • 2
  • 30
  • 30