checking session timeout when using AJAX

Question

I have a ColdFusion page were a user can open a modal and view more information about a row of data. However if the user sits on the page longer than the default 20 minute session timeout, it throws an error because it's looking for the session variables and can't find them. I understand how to trap for this with server side code, but I can't seem to get the AJAX call to successfully determine if the session still exists.

Here's the AJAX code that fires when the user hits the button to open the modal. Basically it's checking if the session exists with a function in a CFC. My problem, is that it always returns 'valid'.

//this checks if the session is expired
function checkSessionExists() {
    $.ajax({
        //this is the that has function
        url: 'components/Admin.cfc',

        //POST method is used
        type: "POST",
        //pass the data        
        data: {
            method: "checkSessionExists"
            },
        async:   false,
        success: function(response) {

            //$('#loading').hide();
            var obj = $.trim(response);

            if (obj == 'expired') { //it's never expired
                alert('Sorry, your session has expired.')
                window.location.href = "logout.cfm";
                return false;
            }

            else{

            }
        },
        error: function(jqXHR, exception) {
            alert('Uncaught Error.\n' + jqXHR.responseText);   
        }
    });
return false;
}

here's the function in the CFC:

<cffunction name="checkSessionExists" access="remote" output="false" returntype="string" returnformat="plain" hint="I check if session is expired."> 

    <cfif NOT structKeyExists(session, "alive")>
        <cfreturn "expired" />
    <cfelse>
        <cfreturn "valid" />
    </cfif>

</cffunction>

I'm thinking that when I ask the CFC if the session is there, it still has the session variables because the page hasn't refreshed in over twenty minutes. So... wondering how I would send an AJAX request to a CFC and have a funciton in the CFC re-evaluate the session variables. Any help would be appreciated thanks!

Answer 1

I'll depend on how you set up your session.alive value. Bear in mind that your code will return 'valid' as long as alive is present in session. If session.valid is set up in session init code, you'l get the response you're seeing.

Any request to a .cfm will cause the session timeout value to reset to now()+session duration. I've used this in the past to :

1. Listen for keyup or click events on the page. If any such event has happened, set a boolean flag
2. Once every few minutes, check the value and send an ajax call to keep the session alive if the value was true. You then set the variable back to false

Then and the cycle repeats. It means that if your users are interacting with the site, their session will be kept open and they won't get thrown out at the end of what they were doing. If your business/site session policy allows, this can be a very nice setup.