Session Management on server side through timer task

[CIAO]

Hi,
What i am trying to do is that I have created a simple login page
through which user identifies himself, after successful authentication
of the user as soon as he enters the data page a cookie is created on
the client side with a session name string in it also the same session
name and the time of creation of the session gets stored in a Hash-map
on the server side say if user does not logs out then his session
continues to persists till the session is timed out. Also at the time
of session expiry the cookie gets deleted and the value from the Hash-
map is removed by a timer task running on the server side. thereby
removing all the information about that session from the application

Now the problem is Say that user has opened a window (Session) and has
forgotten about it then he will remains logged in (Till he refreshes/
Closes the browser/Sign-out) in-spite of the fact that his session has
expired.
What i want to do is that as soon as the timer task discovers that the
session has expired it should send the user information that "your
session has expired" and log him out automatically.

mind that the hash-map used is a static map and its method for
inserting the values has been kept as synchronous to cater to
different browser/Systems

Thanks in Advance
Sunny

[StrongSteve]

Hi Sunny,

You need some kind of polling solution.

For example an invisible frame on the client side that asks the server
periodically (f.e. every second) if the session is still valid.
If not, then this invisible frame will display an alert box on the
client side informing about the session expiration.

Greetings
Stefan

[Sunny]

Hi Stefan,
Thanks for the suggestion but i cannot do that because that will
create too much of network traffic.
Mean While i have found a way to identify the DAEMON THREAD for the
session that has recently expired
but i still need a way to send the message to correct widget, in my
case a Label, to show the message to the user.

Thanks
Sunny

[Bruno Lopes]

Hi

I have the solution :)

Check the file atttached

Hope it helps :)

Bruno

--
You received this message because you are subscribed to the Google Groups "Google Web Toolkit" group.
To post to this group, send email to google-we...@googlegroups.com.
To unsubscribe from this group, send email to google-web-tool...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/google-web-toolkit?hl=en.

[StrongSteve]

@Sunny:
Although you found the thread on the server there is no way (except
polling) to inform the user/client/browser about the occurrence of
this event.

@Bruno:
Nice solution, but it is basically a counter/timer on the client side.
Please correct me if I am wrong. You specify a time and after the time
has run off, the user gets logged off. Except if his is clicking a
special button in the small window of opportunity.

Basically what you all want to do is to kick the user after he/she has
worked for an amount of time.
From my point of view this differs from the concept of session. Those
define a timeout of inactivity time - not a maximum working time
(There is a great difference in limiting the time a user has to max.
30 minutes or set the maximum inactivity time to 30 minutes). If this
time is reached the session object is removed from the server. Why? In
order to free up resources on the server side.
In your client timer solutions how to you ensure that the session
object gets removed from the server?
In order for your solution to work properly you need to start your
server with an infinite session timeout and this can very easily be a
problem if your session-object-free-up mechanism fails.

Greetings
Stefan

On 24 Jun., 14:51, Bruno Lopes <bruno.lourenco.lo...@gmail.com> wrote:
> Hi
>
> I have the solution :)
>
> Check the file atttached
>
> Hope it helps :)
>
> Bruno
>

> > google-web-tool...@googlegroups.com<google-web-toolkit%2Bunsu...@googlegroups.com>
> > .

> > For more options, visit this group at
> >http://groups.google.com/group/google-web-toolkit?hl=en.
>
>
>

>  SessionTimeOutControl.java
> 6KAnzeigenHerunterladen

[Prakash]

Hi Sunny,

http://en.wikipedia.org/wiki/Comet_(programming) : gives overview abt
server side push.

And also you can use HttpSessionListener to listen for session expiry
event, instead of using timer to detect the same.

-Prakash M.

> > > google-web-tool...@googlegroups.com<google-web-toolkit%2Bunsubs cr...@googlegroups.com>

[nacho]

What about the following idea.

The user request some action that needs to go to the server, in your
rpc in the server side you send an Exception, for example
TimedOutException and in your client code check in the onFailure
method which is the exception, if the Exception is TimedOutException
you redirect your user to the logout page.

[Sunny]

Hi All

@Bruno
Thanks for your Effort. I really Appreciate it.
But here i agree with Stefan.
Consider a case that after say 30 minutes the user gets the Message
Box with the special Button
But he has gone out at just 29th minute n will be away for 2 minutes
only.
But since he has not clicked the button when he returns "POOF" his
work is gone!!!
that can be really frustrating...
And moreover nobody would like to bog the user to press a button to
continue a session after every fixed interval of time,
except when you are charging the user for the duration he is using the
facility
So it should be maximum inactivity time.
but that's a nice Effort i can again say that...

@Prakash
That can help i'll look into it for sure.. thanks for the link.
since i have heard about comet programming for the first time it will
require a bit of R&D
Thanks for you suggestion.

@nacho
Well that's the very problem.
I mean that till the user does not presses a button (take it as, sends
a request)
he remains in the system even when his session should have expired.
TimedOutException as you said will only kick in when you "SEND" a
request and recieve the exception in response.
what if the user has left the session open in his office and has
returned home for the day.
there will be no request to process through which i can respond with
the exception...
this keeps him logged in for the whole night.
and with limited number of people allowed to lgin at any given
instance of time
that a wastage of a precious resource.


@ALL
Is there any way to detect when the user has gone inactive??
So that we can user the code provided by "Bruno" by slightly modifying
it to kick in only when the user is inactive
I mean to say that say a user has been inactive for say 5 minutes then
the Bruno's code kicks in and starts it counter pre-setted at 25
minutes
so effectively user gets a message at the 30th minute to press the
button to continue....
this saves the effort of user to press the button everytime till he is
active and still does the work!!!

[Bruno Lopes]

HI I have the solution once again!! :D

The other one is only a timer schedule :D

But this one is a user actions control!! that means if no action is done on the interface for a
specified amount of time  the logout will occur :D

Check the code on the file attached.

and call the the cons after the entry module after a successful login :)

Hope it helps youe needs

Bruno

To unsubscribe from this group, send email to google-web-tool...@googlegroups.com.