Using JavaScript to warn a user about a session timeout
A coworker asked me this today so I thought I'd whip up a quick example. Many bank sites like to use a JavaScript warning to let you know when your session is about to end. Personally these things bug the heck out of me, but in the interest of helping her out (and others), here is a way to do it in ColdFusion and JavaScript. (Explanation follows the code.)
<!--- Minutes into MS --->
<cfset sessionTimeout = 2>
<html>
<head>
<title>Timeout Example</title>
<script>
<cfoutput>
var #toScript((sessionTimeout-1)*60*1000,"sTimeout")#
</cfoutput>
setTimeout('sessionWarning()', sTimeout);
function sessionWarning() {
alert('Hey bonehead, your session is going to time out unless you do something!');
}
</script>
</head>
<body>
</body>
</html>
Let me go down line by line. First off - you can't introspect an application to see what the session time out value is. (I'm sure you could with ServiceFactory methods, but that's cheating.) So I'm using a variable to stand in for the number of minutes a session will last.
<cfset sessionTimeout = 2>
I would probably have set this in the application scope somewhere, but again, this is just a simple demo. I used 2 to make it a bit quicker to test. Now I need to get that value into JavaScript, but there are two things I need to change. First - I want to give the user a warning so she has time to do something. So, I subtract one from the number of minutes. You can obviously subtract more or less depending on how much of a warning you want to give. Secondly, the JavaScript code I'm going to use, setTimeout, expects time in milliseconds. So I take my number of minutes and multiply it by 60 and then 1000.
<cfoutput>
var #toScript((sessionTimeout-1)*60*1000,"sTimeout")#
</cfoutput>
Why didn't I just multiply by 60000? Because I'm dumb and tend to forget things. The 60*1000 helps me remember. What is the toScript function? It lets you convert a ColdFusion variable into a valid JavaScript variable. For more information, check the toScript documentation. Honestly, it's a bit overkill for what I'm doing, but I thought I'd remind folks of this cool little utility. The next line simply tells JavaScript to call my function in the proper number of seconds:
setTimeout('sessionWarning()', sTimeout);
Lastly, my "warning" function is a simple alert. You can use DHTML instead of an Alert or any other JavaScript obviously. But the alert is the simplest way to get your message across.
function sessionWarning() {
alert('Hey bonehead, your session is going to time out unless you do something!');
}
There ya go. To use this on your site you could simply include it in your layout code. Of course, you want to ensure it isn't loaded if the user isn't logged in.
Comments
No luck.
<cfhttp url="http://.....kill.cfm?cfid=##&cftoken=##"; />
Then that page would define the CFApplication tag with no timespan (or < 1 second or something). I never got it to work though. I think part of the problem was that the calling page (page performing CFHTttp) has the same session (in my testing). I would need to set up a scheduled task that did not have a session do call something like that... but then it wouldnt have access to the original CFID/CFTOKEN...
ok, now I am rambling.
GetSessions()... now THAT would be cool... I have SEVERAL uses for that
I'd love to see that if possible.
application.stimeout = this.sessiontimeout
Sami: I did this a while ago so I am grimacing a bit as I look at it now, but essentially I have a table with my alert message that is hidden off the browser screen (visiblity:hidden; left:-100px, top:-100px;). Then I set the timeout value on the page:
timeout = (this.sessiontimeout * 1000) - 1500
I give them an extra minute plus so the CF session doesn't end before they can respond to the alert. When the session timer runs down I change the class of the table so it's visible and give the user 60 seconds to respond. If the 60 second timer runs down without any response from the user, I location.href them to a page that clears their session and displays a message that they have been automatically logged out. I like this because this way they won't fill out a long form and click submit, only to be told that their session has expired. I'd be glad to send you the code, just shoot me an email at robertpilic AT yahoo DOT com if you're interested.
timeout = (this.sessiontimeout * 1000) - 90000
Thanks...
Thanks,
Thanks for the response so quickly. I might not state my throught clearly.
Anyway, You said you would like to store it as a variable. How to do this? I am still using CFMX 6.
Do an iTunes search for "javascript".
There's actually a song called "Javascript Functions".
I don't know why no one thought your question was worth a response, but you can try this:
sessionTimeout = 60000 see above
var sTimeout = #sessionTimeout#
How can I make the dialogue box itself time out if it gets no response?
----
var revive = window.confirm("Your session is about to time out. Do you want to continue?");
if(revive){
var imgAlive = new Image();
var d = new Date();
imgAlive.src = 'alive.cfm?d=' + d;
}else{
location.replace("App_Instructions.cfm");
}
If the user doesn't pay attention to it, it's their own fault.
----
For security, page will time out in
<input type="button" id="timebtn" value="20 minutes 0 seconds." onClick="keepAlive()">
Click button to reset timer and continue entering data.
i greatly appriciate it.