Session expiry

> Hi Seasiders,
>
> I'm wondering how best to handle and avoid session expiry in Seaside.
> I know I can set the time that a session lives to any number of
> seconds, but even a ridiculously high number there isn't really what I
> want. If a page is open in a dusty old tab in my browser for a year, I
> still want to get to the right page if I click on a link some day,
> rather than being redirected to the start page. ;-)
>
> Let's say I'm trying to create a site with a public (unrestricted)
> section and a privileged section restricted to registered users and
> admins. I want pages in the former section to *not* expire at all, and
> I want to be able to find out how much time is left in the session of
> the latter and, if it does expire, redirect to a "session has expired"
> type page. Is that possible? (I mean, hey, it's Smalltalk, so of
> course it's possible, but how do I best go about doing it?)
>
> I've subclassed WASession and set that to be my application's
> #sessionClass. The subclass has an instance variable 'user' and
> methods #isUserLoggedIn and #isUserNotLoggedIn etc. So far, so good. I
> can see from #isActive on WAExpiringHandler that one of the conditions
> is 'self secondsSinceLastAccess < self timeoutSeconds', which makes
> sense. However, if I have the following method on my subclass:
>
> secondsToSessionExpiry
> ^self timeoutSeconds - self secondsSinceLastAccess
>
> it always returns timeoutSeconds, i.e. secondsSinceLastAccess always
> seems to be 0. Investigating this, I find out that the value is 'Time
> totalSeconds - self lastAccess', i.e. it depends on the instance
> variable lastAccess - which is apparently only ever (two cases) set to
> 'Time totalSeconds'...!?! Is that intentional? Should I be overriding
> this behaviour? Am I on the wrong track here?
>
> I'd like to end up with a "session countdown" similar to the
> "periodical" component in the scriptaculous demo, only with something
> like "this session is valid for another hh:mm" instead of the actual
> time.
>
> Any pointers as to what I should override (#pageExpired, #isActive,
> #lastAccess, etc.) would be greatly appreciated.
>
> Cheers,
>
> Amos
> _______________________________________________
> seaside mailing list
> [hidden email]
> http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside
>
>
>  
>

> Check out the mailing list archive. This is a FAQ.
>
> For example to ensure the persistency of a session as long as the user
> keeps its window open can be done by adding some Scriptaculous code to
> your page:
>
> html request
>      every: (sessionExperyTime - 5 seconds);
>      callback: []
>
> This will trigger an asynchronous request 5 seconds before the session
> expires (given a correct vaue of sessionExpiryTime) that keeps the
> session alive for another sessionExpiryTime seconds.
>
> Lukas

> > However, your comment answers my other question as to why the session
> > expiry time was always equal to the session duration: I hadn't
> > realised that the 'every: 1 second' bit effectively causes a request
> > to the server every second (hence resetting the expiry time every
> > second), I'd assumed it was simply JavaScript running on the client
> > (obviously wrong in hindsight).
>
> I wouldn't set it to trigger every second. This causes an unnecessary
> high load on the server. A value that is just a bit shorter than the
> expiry time is fine.

> > > Thanks, Lukas, I did see similar questions in the archives, but the
> > > answer only ever seems to be a workaround, not a complete solution (at
> > > least for me). I'll see if I can work out something for myself just to
> > > satisfy my own curiosity - hopefully without breaking the framework
> > > ;-)
> >
> > No, that's a propre solution.
>
> Sorry, I respectfully disagree. And everyone that I've shown Seaside
> to, as much as they immediately liked it, the reaction to the handling
> of expired sessions is always something that brings up a frown. And
> while using JavaScript to spice up websites is great, sites *should*
> work for browsers without it, or with JavaScript disabled.

> > > > Thanks, Lukas, I did see similar questions in the archives, but the
> > > > answer only ever seems to be a workaround, not a complete solution (at
> > > > least for me). I'll see if I can work out something for myself just to
> > > > satisfy my own curiosity - hopefully without breaking the framework
> > > > ;-)
> > >
> > > No, that's a propre solution.
> >
> > Sorry, I respectfully disagree. And everyone that I've shown Seaside
> > to, as much as they immediately liked it, the reaction to the handling
> > of expired sessions is always something that brings up a frown. And
> > while using JavaScript to spice up websites is great, sites *should*
> > work for browsers without it, or with JavaScript disabled.
>
> Sure, this approach gracefully degrades to the default session expiry
> behavior of Seaside. The JavaScript approach spices up the experience
> so that as long as you keep the window open the session never expires.
> If you want something else, such as bookmark-able URLs, you
> (additionally) need something else.

> "Lukas Renggli" <[hidden email]> wrote in message
>  
>> For example to ensure the persistency of a session as long as the user
>> keeps its window open can be done by adding some Scriptaculous code to
>> your page:
>>
>> html request
>>     every: (sessionExperyTime - 5 seconds);
>>     callback: []
>>    
>
> Where should this ideally be?
>
>  

> "Lukas Renggli" <[hidden email]> wrote in message
>  
>> For example to ensure the persistency of a session as long as the user
>> keeps its window open can be done by adding some Scriptaculous code to
>> your page:
>>
>> html request
>>     every: (sessionExperyTime - 5 seconds);
>>     callback: []
>>    
>
> Would #periodical be equivalent? Can this go into <head> with #updateRoot
> and WAHtmlRoot#addScript:aString?
>
> Or does this go into <body> and need to be wrapped like:
>  html paragraph
>   class: 'hidden';
>   script: (html periodical
>     frequency: 10 seconds ; "just put 10 for testing"
>     callback: []);
>   with: ''.
>
> Also, would this be put into #renderContentOn: of a Page-level object? I
> feel I need a MyPage which always wraps every page, simply holding onto a
> single top-level component, and I would like to know if there is a simpler
> way:
>
> MyPage >>
> My instances represent page-level objects. They can provide a place for page
> level stuff like:
> - batched list of dirty components waiting to be Ajax-redrawn
> - page-level insertion e.g. keep-alive callback
> To use a component as top-level page do:
> Component class>> new
>  ^ MyPage with: self new
>
> Thanks - Sophie
>
>