Accidental Logouts when session expires

[MaheshkumarSundaram]

Hi @neonexus

As far as I am aware, I don't think the current source code handles accidental logouts when session expires despite the user being active. I did check isLoggedIn.js policy.

It would be good to include this whenever you have some time for this. I can implement it myself. But I am wondering what would be the ideal/effective way to achieve this? Some options:

• Implement a sliding window for session extension
• Client-side activity monitoring
• Warning before expiration and option to extend by re-authentication

[neonexus]

@MaheshkumarSundaram can I get a little more context on this issue? How are sessions expiring while being active?... This sounds like an issue we've had in the past with "session" cookies vs timed cookies.

[MaheshkumarSundaram]

Sorry @neonexus. My phrasing was quite ambiguous. When I said active, I meant they are actively doing something on the front-end. To give you a bit more context, there is no issue with session handling. The problem is more on an use case which is not specific to this boilerplate. Say, in production environment, I have my session config to

 expiresAt: {
        amount: 1,
        unit: 'days'
    },

Now a user logs in and does actions and leaves the webpage idle. Say after 23h, the users comes back and the session is valid still. Now the user say types in a long document in the front-end which takes an hour. Now, when he tries Save triggering an API call which would fail as the session has expired.

I suppose these kind of use cases are more project specific rather than being dealt at a boilerplate level.

[neonexus]

@MaheshkumarSundaram Yeah, this sounds project specific. Generally speaking, sessions last longer than a day; when a project requires shorter time-outs, it's a good idea to consider something like a "heartbeat" (phone-home / ping, etc), or when certain activities / pages are activated, to verify session is still valid.

[MaheshkumarSundaram]

@neonexus Thank you. Yes, I am planning to implement a hearbeat mechansim to handle this.