How to close session on user inactivity in Liftweb when using AJAX and Comet

Question

Please advise the best way how to set up closing of session when working with AJAX and Comet in Liftweb.

Currently sequntial requests of Comet and Ajax connections resets timeout if it greater than 2 minutes and session is not closed, even if the user is not active.

Answer 1

Since Lift implements long polling as part of it's comet support, the server can not easily differentiate between a user having no activity and the user's browser simply making a polling request. If they close the page, the session would timeout normally.

For me personally, not timing out is usually better since if the user walks away but leaves the page open, they don't time out (particularly useful when they are in the middle of working on something). But everyone's requirements are different.

I think the easiest thing to do would be to use a javascript library to detect a period of inactivity and then send a request to the server to end the session. I am sure there are others, but I found this one while googling: http://www.paulirish.com/2009/jquery-idletimer-plugin/ and it seems pretty easy to setup.

As far as the having the server handle the request, you could use Lift's dispatch to create a URL which would terminate the active session, something like this in your Boot.scala should work:

LiftRules.dispatch.append {
  case Req("logout" :: Nil, _, _) =>
    S.request.foreach(_.request.session.terminate)
    RedirectResponse("/")
}

Accessing /logout will invalidate the session and then redirect the user away. So you'd just need to have the javascript issue a redirect to that URL on some period of inactivity and the user will be logged out.

Answer 2

I think this rather refers to your "web application container", like jetty or tomcat. You should specify the session timeout there.

(You may do a hard session reset from inside Lift, clearing all the cookies and allocated memory, but I think it's better to solve the problem as I described first.)