js handles account logout when closing the browser
Classic approachAs we all know, for the sake of account security, when the user does not actively click to log out of the system, the method of directly closing the browser or tab to force log out of the system is:
//Call the logout interface when closing window.onbeforeunload = function() {
//Execute the logout ajax call, simple example $.ajax({url:"/logout"});
};
questionThis method has serious problems. It will cause logout to be called when refreshing the page. Many systems must support refreshing the page to maintain the session. How to deal with it? There is no solution, but it works:
//Call the logout interface when closing window.onbeforeunload = function() {
//Execute the logout ajax call, pass in the flag, and tell the backend to delay the logout$.ajax({url:"/logout"},data:{delay:true});
};
The background logout interface sets a timer according to the delay flag to delay logout. For example, if a 5-second timer is set, the application system session will be actually logged out after 5 seconds. At the same time, after the front-end page is loaded, a clear logout interface should be called immediately to tell the background to delete the delayed logout timer to ensure that the previous logout operation is abandoned when the page is refreshed to maintain the application session. Further questionsHow much delay is reliable for background timer? Of course, we hope that the shorter the better, because this ensures that after the user closes the browser and reopens the page, the session will not be restored. For example, a 5-second timer is set in the background. As long as the interval between the user closing the browser and reopening the page is greater than 5 seconds, the session will not be restored, ensuring that the user re-enters the login page. Of course, if the user's hand speed is too high and the page is reopened within 5 seconds, the previous session will be successfully entered. Of course, this will not cause serious problems, because a malicious user cannot use the computer that the user left and open the page very quickly. Then what? How many seconds of delay should be set? This depends on when the front-end code calls to clear the delayed logout timer when loading the page. The key point is that the sooner the better.
<html manifest="">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta charset="UTF-8">
<meta http-equiv="Pragma" content="no-cache">
<meta http-equiv="Cache-Control" content="no-cache">
<meta http-equiv="Expires" content="0">
<script type="text/javascript">
//In order to call and clear the delayed logout timer as soon as possible, use the original XMLHttpRequest method to call var xhr = new XMLHttpRequest();
if (xhr) {
xhr.open("POST", '/clearlogout', true);
xhr.send();
}
</script>
......
After the above processing, under normal network conditions, the refresh page operation can ensure that the time interval between calling the delayed logout and clearing the delayed logout is very short. Generally speaking, 5 seconds is a more reasonable delay value. Issues that need attention Obviously, the above mechanism must rely on the backend two-layer session mechanism, because the premise is that it must first support the refresh page session retention, so the surface layer is the session of the web framework itself, and the inner layer is the application layer session. Surface sessions rely on cookies, while inner application sessions rely on background cache mechanisms or databases This is the end of this article about how to log out of an account when closing the browser using js. For more information about how to log out of an account when closing the browser using js, please search for previous articles on 123WORDPRESS.COM or continue browsing the following related articles. I hope you will support 123WORDPRESS.COM in the future! You may also be interested in:
|
<<: CSS Naming: BEM, scoped CSS, CSS modules and CSS-in-JS explained
>>: MySQL multi-instance installation boot auto-start service configuration process
Recommend
Mac installation mysqlclient process analysis
Try installing via pip in a virtual environment: ...
How to change the mysql password on the Xampp server (with pictures)
Today, I found out while working on PHP that if w...
Application of CSS3 animation effects in activity pages
background Before we know it, a busy year is comi...
Detailed explanation of the difference between the default value of the CSS attribute width: auto and width: 100%
width: auto The child element (including content+...
Detailed explanation of Kubernetes pod orchestration and lifecycle
Table of contents K8S Master Basic Architecture P...
Solution to the problem of z-index not taking effect in CSS3
I recently wrote a combination of CSS3 and js, an...
How to configure MySQL master-slave replication under Windows
MySQL master-slave replication allows data from o...
Solve the mobile terminal jump problem (CSS transition, target pseudo-class)
Preface Many friends who have just come into cont...
Tutorial on installing MySQL 5.6 using RPM in CentOS
All previous projects were deployed in the Window...
Hello dialog box design experience sharing
"What's wrong?" Unless you are accus...
The difference and usage between div and span
Table of contents 1. Differences and characterist...
JavaScript web page entry-level development detailed explanation
Part 3: ❤Three ways to overlook backend data rece...
Common pitfalls of using React Hooks
React Hooks is a new feature introduced in React ...
Pure CSS to achieve click to expand and read the full text function
Note When developing an article display list inte...
Modify the maximum number of mysql connections and configuration files in docker
1. Find the mysql image docker ps 2. Enter the mi...