Micheal's right - you'd have to warn them BEFORE the session times out to do anything, after it's timed out it's gone and can't be recovered.
If you want to use JavaScript I've a piece of script that will do this for you - in fact it could automatically keep the session active as well. The technique is an old one, but still very useful (long URL to follow): http://www.depressedpress.com/depressedpress/Content/Development/JavaScript/ Articles/GIFAsPipe/Index.cfm Your client script would set a timer for, say, 18 minutes (if your session timeout were the default 20). It would say "You will be timed out in 2 minutes, do you want to stay logged in?" You might also want to display the time of the alert (so that if they come back to the application after the deadline they know why it doesn't work). If they say "yes" you would use the GIF-as-a-Pipe trick from the article to hit a page, any page really, that's a member of the application. The user's page hasn't changed, but they're given another 20 minutes. To use this as a session monitor remember that page only keeps the session active if the <CFAPPLICATION> tag is run. So you might have a CFM page like this (pseudo-code): <cfif IsDefined("URL.KeepSessionActive") AND URL.KeepSessionActive EQ "Yes"> <CFAPPLICATION...> </cfif> This way you could have a client-side timer than runs, say, every 10 minutes. Any client-side activity (even bubbling makes this REALLY easy in IE) could set a variable that indicates "activity" (filling out a long form, for example) and calls the page with "KeepSessionActive=Yes". By default, however you would call the page with "KeepSessionActive=No". Lastly remember that when using this technique you get the benefit of an additional hit on your logs. You can throw whatever client-side information you like onto the image call - and it all gets tracked in your log files. You might, for example, decide to track the local ("#name") links in a page and make sure that the session is kept active even when only those links are being used. Of course this does require client-script, but it's very useful when you can control the user-environment (admin systems, intranets, etc). For true, public, end of session handling I use a rather elaborate system which keeps the session information in the Application scope. This means that I have to manually "time out" sessions, but also that I can do whatever I like with the information before it gets deleted. I can share the code with you if you like, but it isn't a quick paste in. ;^) Jim Davis ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Special thanks to the CF Community Suite Gold Sponsor - CFHosting.net http://www.cfhosting.net Message: http://www.houseoffusion.com/lists.cfm/link=i:4:188196 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
