How to set session timeout per user

[ICI-MASA]

Hi,

Ho do I set the session timeout per User in the Application.cfm File??

I tried using

<cfif SESSION.UID EQ 1>
<CFAPPLICATION NAME="appControl" SESSIONMANAGEMENT="Yes" sessiontimeout="#CreateTimeSpan(0,0,20,0)#">
</cfelse>
<CFAPPLICATION NAME="appControl" SESSIONMANAGEMENT="Yes" sessiontimeout="#CreateTimeSpan(1,0,0,0)#">
</cfif>

But this didnt work because the cfapplication seems to have to be at the top before I call the variable SESSION.UID which
I set on my login page..

Someone know how to do this??

Regards
Martin

[keyman2006]

I have set this in the login page, based on the class of user that I had on file for a valid userid.
For publicly-located machines, I have also used a visible input field for the session-length in minutes, with a short default value that the user could change (up to a maximum based on type of userid). Not sure if that answers your question...
-keyman

[ICI-MASA]

thx keyman for the response,,,

so if you could write an example of how you would write this in the code for the login page.. what variables do you use?

regards
Martin

[BKBK]

Almost always, whenever logic like yours seeks to interfere with the cfapplication tag, it's a sign there's something wrong with the design. I would just put something like the following in Application.cfm and forget all about it.

<cfapplication name="appControl"
clientmanagement="Yes"
sessionmanagement="Yes"
sessiontimeout="#CreateTimeSpan(0,0,20,0)#"
applicationtimeout="#CreateTimeSpan(1,0,0,0)#"
setclientcookies="Yes">

[Aboromo]

Martin,

Your code example cannot work because the "session" scope doesn't exist until your application scope is defined. So you have to handle this manually. Here's how you can get it done. First, define your application to the maximum sessiontimeout you want to have.

<CFAPPLICATION NAME="appControl" SESSIONMANAGEMENT="Yes" SESSIONTIMEOUT="#CreateTimeSpan(1,0,0,0)#">

Then, I don't know how you are doing your login authentication but when you have authenticated the user, you need to define the userid and the most recent activity in the session. Also determine your timeout value based on the userid. See example:
<CFIF IS_AUTHENTICATED>
<CFSET session.user.uid = form.userid>
<CFSET session.user.most_recent_activity = now()>
<CFIF session.user.id eq 1>
<CFSET session.user.timeout_mins = 20>
<CFELSE>
<CFSET session.user.timeout_mins = 1440>
</CFIF>
</CFIF>

Now, all you have to do is check whether the user has been idle for too long and kill the session by purging all session variables. For example:

<!--- if user id is defined, this means user is logged in --->
<CFIF structKeyExists(session, "user") and structKeyExists(session.user, "id")>
<!--- check if timeout has expired --->
<CFIF datediff("n", session.user.most_recent_activity, now()) gt session.user.timeout_mins>
<!--- timeout has expired, kill the session and log the user out --->
<CFSET StructClear(session)>
<!--- insert your logout code here --->
<CFELSE>
<!--- user hasn't timed out, so reset the most recent activity to now --->
<CFSET session.user.most_recent_activity = now()>
</CFIF>
</CFIF>