cookie timeout

[hc1619]

OK I'm using cookies rather than session variables to track my users. So instead of setting <cfset Session.MemberID = #Record.MemberID#>, I'm setting a cookie with the #Record.MemberID# inside of it.

I have a Logout button, and that works fine.. I click that and it gets rid of the cookie.. but my problem is if I'm idle for 20 minutes and come back and refresh the page, I'm still logged in because the cookie is still there. Usually with session variables they have a timeout of 20 minutes... how can I replicate this same behaviour with my cookie? Ie, if someone is idle for 20 minutes I want them to be logged out.

 

[webmigit]

The sneaky way would be to fill a cookie variable with a date/time at login and do a datediff("n",datecookie,now())..

If its older than 10, 20, whatever, just clear the cookie..

<cfif datediff("n",datecookie,now()) gt 20>
...clear cookie...
</cfif>

ALFII.com

http://www.alfii.com

---------------------
If this post answered or helped to answer your question, please reply with such so that forum members with a similar question will know to use this advice.

 

[NorthStarDA]

could you not just set a time-out for your cookie? if you wanted users logged out after 20 minutes of inactivity you could set

<cfset expiretime = #DateAdd("n",20,"Now()")#>
<cfcookie name="MemberID" value="#Record.MemberID#" expires="#expiretime#">

then when the page loads..
<cfif IsDefined("Cookie.MemberID")>
they are still logged in
<cfelse>
they are not logged in anymore
</cfif>

 

[NorthStarDA]

another thing i just thought of is how you would handle sessions with cookies and time-outs, you would have to re-set the cookie on each page after the check to see if it is there, else the session would time-out after 20 mins whether they were active or not, the expires attribute needs to be updated everytime they move from page to page.

 

[webmigit]

Hadn't considered that aspect (your second post)... ACtually though what you could do is check and see if its older than like 10 minutes.. If it is, then you can refresh the cookie... something like...

<cfif datediff("n",datecookie,now()) gt 10>
<cfif datediff("n",datecookie,now()) gt 20>
...clear cookie...
<cfelse>
reset cookie...
</cfif>
</cfif>

So then the update doesn't occur very often..

Also cfcookie-expires does not support a time.. only date.. According to livedocs..

http://livedocs.macromedia.com/coldfusion/6/CFML_Reference/Tags-pt119.htm

ALFII.com

http://www.alfii.com

---------------------
If this post answered or helped to answer your question, please reply with such so that forum members with a similar question will know to use this advice.

 

[NorthStarDA]

thats very strange, the built in cfmx reference in dreamweaver says it can be a date or date/time variable. oh well, not the first time I've seen contradictions in the docs... I'll have to try it out and see if it works with a time object.

 

[hc1619]

obviously setting a timeout on the cookie would solve all problems.. but i've been told that expires attribute will only hold days and NOW or NEVER.. it doesn't handle minutes?

im thinking i might just go back to session variables.. i mean i only had one session variable i was using.. perhaps it might be easier.