From: Sean Kinsey on
On Apr 8, 11:37 am, Thomas 'PointedEars' Lahn <PointedE...(a)web.de>
wrote:
> Sean Kinsey wrote:
> > To propose the only way it _could_ work:
> > * In a pre-unload event, run a sync XHR/equivalent that modifies the
> > session to expire in a minute amount like 10 seconds.
> > * If the client does not issue a new request to the server, the
> > session expire normally
> > * If the client issues a new request before expiration, then the
> > regular session expiration extension mechanism kicks in and extends
> > the session.
> > Actually, I might just do the above, sounds  like fun!
>
> Idiot.  I have proposed that approach yesterday.

Sure you did.. Was it in the post where you also proposed displaying
new HTML documents using Image?

>
> <news:11375999.mABFhMhkbZ(a)PointedEars.de>
>
> PointedEars
> --
>     realism:    HTML 4.01 Strict
>     evangelism: XHTML 1.0 Strict
>     madness:    XHTML 1.1 as application/xhtml+xml
>                                                     -- Bjoern Hoehrmann

From: Sean Kinsey on
On Apr 8, 11:26 am, Antony Scriven <adscri...(a)gmail.com> wrote:
> On Apr 8, 8:58 am, Sean Kinsey wrote:
>
>  > [...]
>  >
>  > It has already been discussed and this is still not
>  > possible to use. It can, and is, used to persist the
>  > session, but cannot be used to notify the server about
>  > a navigation due to the code not knowing if the
>  > navigation is a safe refresh or not.
>  >
>  > To propose the only way it _could_ work:
>  > * In a pre-unload event, run a sync XHR/equivalent that
>  > modifies the session to expire in a minute amount like 10
>  > seconds.
>  > * If the client does not issue a new request to the
>  > server, the session expire normally
>  > * If the client issues a new request before expiration,
>  > then the regular session expiration extension mechanism
>  > kicks in and extends the session.
>  > Actually, I might just do the above, sounds like fun!
>  >
>  > [...]
>
> And what if the server requests arrive in an order different
> from what you expected? --Antony

That was the point of the "sync XHR/equivalent" statement, to ensure
this request has run prior to the actual navigate event.
But as some would say, 'what if the network goes down and the request
cannot be completed?'; well, that has no negative effect compared to
the primary solution.
From: Thomas 'PointedEars' Lahn on
Sean Kinsey wrote:

> Thomas 'PointedEars' Lahn wrote:
>> Sean Kinsey wrote:
>> > To propose the only way it _could_ work:
>> > * In a pre-unload event, run a sync XHR/equivalent that modifies the
>> > session to expire in a minute amount like 10 seconds.
>> > * If the client does not issue a new request to the server, the
>> > session expire normally
>> > * If the client issues a new request before expiration, then the
>> > regular session expiration extension mechanism kicks in and extends
>> > the session.
>> > Actually, I might just do the above, sounds like fun!
>>
>> Idiot. I have proposed that approach yesterday.
>
> Sure you did.. Was it in the post where you also proposed displaying
> new HTML documents using Image?

So you can't read, too.


PointedEars
--
var bugRiddenCrashPronePieceOfJunk = (
navigator.userAgent.indexOf('MSIE 5') != -1
&& navigator.userAgent.indexOf('Mac') != -1
) // Plone, register_function.js:16
From: Scott Sauyet on
Thomas 'PointedEars' Lahn wrote:
> Sean Kinsey wrote:
>> To propose the only way it _could_ work:
>> * In a pre-unload event, run a sync XHR/equivalent that modifies the
>> session to expire in a minute amount like 10 seconds.
>> * If the client does not issue a new request to the server, the
>> session expire normally
>> * If the client issues a new request before expiration, then the
>> regular session expiration extension mechanism kicks in and extends
>> the session.
>> Actually, I might just do the above, sounds  like fun!
>
> Idiot.  I have proposed that approach yesterday.
>
> <news:11375999.mABFhMhkbZ(a)PointedEars.de>

When you proposed that solution, Sean responded

| A server-side expiration quite similar to the one you explained is
the
| main approach, the popup is only there to allow for a faster reset

You didn't seem to notice that Sean understands that a server-side
solution is the only completely reliable one, that he is using a
client-side solution to improve the user's experience when possible.
And as server-side session expiry is frequently in the 30-minute-
range, this can be a substantial improvement for the user who forgets
to log out.

The solution he suggests above goes further than your original
suggestion, though, by modifying (on page unload) the server-side
timeout to a much shorter period. I don't know how well the solution
will work. It strikes me as a bad idea for a browser to allow *any*
HTTP requests inside the page unload, but I know that window.open(url)
does work so maybe a synchronous XHR request will too.

I'm not saying that I would support Sean's suggestion, but you are not
doing him justice with your insults.

-- Scott
From: Antony Scriven on
On Apr 8, 4:24 pm, Scott Sauyet wrote:

> [... about automatic log out ...]
>
> [...] Sean understands that a server-side solution is the
> only completely reliable one, that he is using a
> client-side solution to improve the user's experience
> when possible. [...]
>
> The solution he suggests above goes further than your
> original suggestion, though, by modifying (on page
> unload) the server-side timeout to a much shorter period.
> I don't know how well the solution will work. It strikes
> me as a bad idea for a browser to allow *any* HTTP
> requests inside the page unload, but I know that
> window.open(url) does work so maybe a synchronous XHR
> request will too.

Synchronous requests don't tend to improve the user's
experience. --Antony