Does mouse activity on a portal screen count as session logout activity or not?

Issue

  • Need to confirm whether mouse activity on a portal screen will count as session logout activity or not? For example, if there is merely mouse activity (and not particular clicks or screen loads or reloads), it is unclear whether the user will be logged out or not.

Environment

  • Liferay DXP [all versions]

Resolution

  • Concerns are frequently raised about mouse activity, which consists only of moving the mouse pointer across the screen without clicking or refreshing the page. If so, will it count towards the user session timeout?
    • Firstly, let's be clear that the application server maintains the sessions, not the Liferay portal, so if the session is lost, it implies that no request has reached the application server within the given time, which in this case is 30 minutes (let's say in DXP 7.4)
    • Now, if the concern is still the same that the mouse activity should be considered, which is not achievable under the existing DXP implementation because we haven't implemented such calls in the background that should take consideration of mouse activity, also, this doesn't seem a recommended approach if we consider the user's security.
  • However, users can certainly modify the session timeout according to their requirements if they want the session length to be longer from a DXP standpoint. Please refer to the following articles for more information in this case:
    1) How to Change the Session Timeout Value
    2) Session Management in Liferay
  • Whereas, if they let the browser/screen be in control of the session timeout i.e., if users want the JavaScript to be fully in control of how long the session lasts, so that it is renewed whenever the user types, moves the mouse, or whatever, they will have to keep making Ajax-requests in the background to their server, so the session is renewed. (That could be an empty dummy request, just something that hits the server)
    • Users (or developer) would then have to track all actions you consider 'end-user activity' and reset the timeout timer whenever such an event occurs. If the end user is inactive for too long, they would then have to make an Ajax request to a page on the server, that invalidates the session, and then user can alert the end-user that the session has timed out.

Additional Information

  • Please take note that the information above is a basic outline of user session concepts on the mouse activities obtained from one of the customer's use cases. However, please open a support HC ticket if there are any other session-related concerns, and a support engineer will respond as needed.
¿Fue útil este artículo?
Usuarios a los que les pareció útil: 0 de 0