You are here

Session Timeout Question

Submitted by sspyrison on Wed, 01/19/2005 - 23:55

LDN,

We have an issue that is causing us some usability problems and general headaches...so I'm looking for the collective wisdom of LDN to maybe get some input.

At NLU, we use the user-configurable session timeout feature, which works fine. I don't have any reports of general timeout problems. Our problem stems from a particular channel. Probably like many of you, our library subscribes to databases. We restrict access to those using Luminis...in a nutshell, the resources are only available as a channel in Luminis.

Currently, it's a simple Inline Frame pointing to a URL that contains the resources. Without going into too much detail, the resources are served through EZProxy which is where further access control happens.

The problem is, activity within the Inline Frame is not recognized by Luminis. For example, if I'm a user and my timeout is set to 20 minutes, I could be actively doing research within the Inline Frame but Luminis times me out after 20 minutes. Many complaints from users on this...

We've tried a number of things already, with no luck whatsoever. Has anyone encountered this in their own portal implementations, or does anyone have any ideas on how to work with, reset, or get around the Luminis session timeout? I've got case(s) open with SCT on this, but no solution.

Best Regards,
Scott Spyrison
National Louis University

Scott,

I'm glad you posted as I'm going to be integrating our library pages soon.  Thanks for the heads up.  I've worked through a prototype of a possible solution for our (and other's I'm sure) problem.

There's probably an easier way to do this, but I don't know of one, so here's my idea in a nutshell:

Have the inline frame call a page, we'll call it keepalive.html, which contains an inline frame to the library page.  'keepalive.html' keeps track of whether the user's mouse is 'in' or 'out', and activates/deactivates a javascript timer accordingly.  When the mouse moves in, the timer would be set to 5 minutes or so, and if it ever fires, it requests a page from the Luminis parent frame which should reset the Luminis session timeout.

I've tested the in/out status, and conceptually at least, the rest should work as well.

Let me know what you think.

Brian Starks
Software Engineer
Utah Valley State College

Hi Brian,

Thanks for posting. I think we tried the other end of what you did. You started with the JavaScript timer, and we started with trying to call a page off Luminis.

We tried was the following:

1) Create the channel as an Inline Frame
2) The contents of the Inline Frame point to a frameset hosted on the Luminis server.
3) The main frame pointed to our library resources
4) An 'invisible' frame at the bottom refreshed a page off the Luminis server at a set interval.

This didn't work for us, but now that we're having this discussion I'm wondering what would happen if we re-tested the above with a baseline Luminis page as the 'invisible' frame that refreshes. Maybe one of the help files or something.

You'd think there would be an easier or more elegant way to do this, no? I had high hopes for the WebProxy channel, but as far as I can tell it doesn't proxy anything in the true sense of the word.

You may want to take a look at the Luminis email client. I'd have to ask the person that looked into it, but if I remember correctly the compose screen uses JavaScript to keep your session alive while composing a message.

You're 100% right. After a while SCT got back to me on an open case and told me what servlet to call. It is the same one referenced in the email compose window...it returns a blank gif or something and resets the session timeout.

If interested, it's:

http://luminis.server/cp/wu/rt?t=

Where the timeout is meant to force anything that's cached in a proxy or by the client.

All that being said, we are not willing to do this. The tradeoff in security is too great. Also, I've got it on my list to go test the email compose window and see if it times out or not.

They also told me that the proxy channel does in fact proxy content, but not images. So, a client web browser will open a connection to the remote site to retrieve images.

Scott