Logout on inactive #58
Conversation
The idle modal shows after 25 minutes of inactivity. After 30 minutes of inactivity the user is logged out of the TTA smart hub. If the user becomes active while the modal is displayed it is hidden and the 25 and 30 minute count is reset. Currently when the modal is shown the message says how long the user has until logout when the modal was first shown. I see two ways to improve the user experience: 1. We have a running countdown that updates until the user is logged out 2. We display the actual time at which the user is logged out (e.g. 10:55 am)
|
|
There was a problem hiding this comment.
Looks good! 👍
One comment on the text. Should "You will automatically be logged out..." be "You will be automatically logged out..." It sounds better, although I'll defer to @arickalewis1 on it.
There is a potential issue if a user is active on a page but not making API calls for 30 minutes. In that case the user's session will expire but they won't get explicitly logged out on the frontend. If this happens the next call to the API will give a 401, which we will need to handle. I gave some thought to having a 'heartbeat' API endpoint that gets hit periodically, but things get complicated when combined with the inactivity timeout. Let me know if you have any ideas!
This might be less of an issue with an autosave which will send changes to the database. I think if we redirect users to login on the backend when using various endpoints, we would eliminate the scenario when someone is active and just reading (not using the backend api) and then clicking to access the api.
I do worry about this scenario, especially for the PS users, since they won't really be entering any data into the system for the MVP (though theoretically/hopefully they'll be hitting various GET endpoints as they navigate to different reports). What about the inactivity timeout was causing issues? Potential idea: hit a heartbeat api every 15 minutes as long as the page is open in a browser tab. That will keep the backend session open while the user is potentially just reading, but allow the timeout to happen if the tab is closed. If the frontend timeout triggers because the tab is open but abandoned, then its proactive call to 'logout' will override the heartbeat keeping things alive. |
|
Description of change
The idle modal shows after 25 minutes of inactivity. After 30 minutes of inactivity the user is logged out of the TTA smart hub. If the user becomes active while the modal is displayed it is hidden and the counters are reset.
Currently when the modal is shown the message says how long the user has until logout when the modal was first shown. I see two ways to improve the user experience:
How to test
I've set sandbox to show the logout modal at 1 minute of inactivity and to logout users after an additional minute (2 minutes total). I'll need to remember to update the environment variables to 25 minutes (modal) and 30 minutes (logout) before merging.
Notes
Issue(s)
Checklist
Documentation updated