Log out when browser is closed

ELV1I2 · #1 (**permalink**) 07-17-07, 10:54 AM

I think that I'm understand phenomena called session (PHP 4.4.2). After successfully login there is user name and password reachable by $_SESSION...
For security reason it's smart to do unlogin or log out on computer, especially when it's a one on public place in order to suppress unwanted access to your information after you leave computer without log out option.
Is there some mechanisms that could log out user when he/she close web pages without prior log out? Javascript or so..?

Thanks.

mgfca · #2 (**permalink**) 07-17-07, 04:03 PM

When browser is closed the session is lost...when you open browser again the session is a new one...
The only situation someone would open the browser and find someone else's account logged-in is when you use cookies (its recommended users only use cookies on their own computer) thats why many login forms have the "remember me" option at login

ELV1I2 · #3 (**permalink**) 07-18-07, 11:05 AM

I don't agree with you at all...session is lost when a user closed browser. But in browser that support tabs many user simply close the unwanted tab without prior logout and session is still there! Anyone who has access later to this computer could misuse remained session of previous user, isn't?

mab · #4 (**permalink**) 07-18-07, 11:34 AM

Closing a tab in a browser does not close the browser. It is necessary for the whole browser to be closed and this only applies if the session cookie has a zero lifetime.

It "should" be possible to use an onUnload event to request a url on your server that signals that someone has left a page, however I don't think this applies when a browser is actually closed (someone correct me if I am wrong.)

You cannot control how a user leaves his computer sitting when he is not there. If they login to your site and leave that page open in their browser and get up and someone else sits down and starts making changes... that is really their problem and you can not even detect that anything like this has occurred.

Likewise, if someone has a key logger/virus on their computer and their login name and password has been captured... that is really their problem and there are only limited things you can do to detect if someone else is logging in using their name and password.

ELV1I2 · #5 (**permalink**) 07-18-07, 02:36 PM

Your story is very wise mab, I appreciate it. All what you say is true, that's sure, but I remember of my apps for WIntel platform where 2/3 of whole code is dedicated to suppress a user not to press this one or this one... just 1/3 is usefully code

I thought that maybe is some simple methods for this purpose but as you said already, like for credit card PIN code, for log out process is responsible only a user, no one other. Thanks for your opinion.

mab · #6 (**permalink**) 07-19-07, 11:59 AM

Here is some tested code that works in IE7 that requests a url when you navigate away from a page or close the browser -

PHP Code:


			
<html>

<head>



<script type="text/javascript">

function mymessage()

{

<?php

  // this is PHP... so that you could form a url of your choice with parmaters... as needed

  echo "  location.href=\"closed.php\"";

?>

}

</script>

</head>



<body onunload="mymessage()">



<p>time() will be written to a file when you navigate to a different url or close the browser (at least for IE7)</p>

</body>



</html>

The closed.php code in the location.href="..." statement -

PHP Code:


			
<?php

// note if you attempt to navigate to a different url, you will see the following echo

// if you close the browser, there is no browser to display this, but this page is requested and executes

echo "the user navigated to a different page or closed the browser";



$handle = fopen("log.txt", "a");

$somecontent = time() . "\r\n";

fwrite($handle, $somecontent);

fclose($handle);



// in real life going to this page will prevent a person from directly navigating

// away from your page, you would need to see if you can capture the url they

// entered and then redirect to that page.

?>

But this is only an example that demonstrates that it is possible to use the onunload event.