4

I dived into the Mendix session behavior and want to share my findings in the hope that it helps some one and that Mendix will rethink the session (timeout) behavior. When you are using Firebug you'll notice the #KeepAlive request that the client will send to the server. In the M2ee config it's possible to set EnableKeepAlive to False. I expected that the client will stop sending the #KeepAlive request, but that isn't the case. After some debugging I found out what the EnableKeepAlive settings really does, namely: "EnableKeepAlive : True means that the KeepAlive request that the client is interpreted as user interaction and that it will reset the Session timeout." "EnableKeepAlive : False means that the client still send the KeepAlive request but now the server isn't interpreting the request as user action and the session timeout won't be reset." Example 1 So what does that mean. An example: the timeout is configured as 10 minutes and EnableKeepAlive has value True. This are the Mendix defaults. When a user logs in the client starts sending #KeepAlive request every 5 minutes (it's always at the frequency of half of the session time out value). Let's say the user does nothing, just let the app stay opened. Then his session will NEVER expire. That's because of rule 1, #KeepAlive request is seen as user action by the server. So the conclusion: Mendix sessions doesn't expire by default when the user has the browser opened. The only scenario when the server removes the session at session timeout in this case is when the browser is closed and the user didn't properly logout. Example 2 For the most application that's not what you want. The only thing you can do is set EnableKeepAlive to False. Now the client will still send the #KeepAlive request but the server doens't see it as user action and you're session will be removed server side if the user doesn't do anything in the client. Great, you will think, that's what we wanted. But now you'll have an other issue. Because the #KeepAlive is send at half of the session timeout time it can take minutes for the client before it's aware of the fact that the session is removed. Example: session timeout = 10 minutes, EnableKeepAlive = False. User logs in and this can happen: Minute 5 - #KeepAlive Minute 7 - User does something, serverside the timeout value is back to 0 Minute 10 - #KeepAlive Minute 17 - Server removes session because of 10 minutes timeout Minute 20 - #KeepAlive by client and client redirect the user to the login form. So here's a gap of three minutes before the client redirects the user. EDIT: the client redirects because it gets a 401 Not authorized on the #KeepAlive request. My suggestions for changing the platform behavior (and I'm curious what the opinion of the community is) are: Set EnableKeepAlive default to False. Introduce a new property CheckSessionAlive in milliseconds. At that interval the client checks if the session is alive so you can prevent a gap of three minutes. Optional: Rename the EnableKeepAlive property to "InterpretClientKeepAliveAsUserAction", because that's what it does and is much clearer. With this additions you can do the things you actually want. For example: EnableKeepAlive = false, SessionTimeout = 10 minutes, CheckSessionAlive = 1000MS (performance wise1000MS should probably be a minimum). With this configuration you're session will expire after 10 minutes of no action and just 1 second later you are redirected to the login form.

asked 2013-10-14

1 answers