Session Timeout

Targets Web
1

Hello.

This is my first go at building a Xojo Web App for production purposes.

I have a question:

I created a web container that allows the user to enter username and password in order to log into the system.

Task 1:

Knowing that users sometimes get distracted and leave the browser open (sometimes for hours), I’d like to have the Session timeout after about 5 minutes of inactivity.

Task 2:

In addition to this, after the user successfully logs in, there are times when the user may go to a different website that has nothing to do with my web app. However, if they return before the session times out, then I’d like for them to not have to log back in (essentially use the credentials previously entered).

I know that’s a chunk right there, but any guidance you have would be great on how to accomplish both of these tasks.

Thanks!

2

What an exciting time for you as Xojo Web is a very interesting platform target and set of tech.

For #1, you can use the UserTimeout property to set the number of seconds before the UserTimedOut event occurs.

For #2, off the cuff I’m thinking that a short-lived cookie with a session token, like a UUID, can be used. Maybe set the cookie to HttpOnly, Secure, an appropriate SameSite policy and set the Max-Age to correspond to when the session expires.

This cookie token can be used to reconnect to the session if returning before the session times out. Of course, the next logical item here would be for the session itself to track state along the way, so that when returning to the session, the UI state could be restored.

Hope this helps.