无需 JavaScript 即可自动注销？这种解决方案的含义是什么？
所以我需要为 WordPress 实现自动注销功能。对于 JavaScript，这似乎很简单；
- X 分钟后提示 idle (jQuery.nap)，交替
</code> 来引起注意 - 如果 Y 秒后没有确认，则运行 logout
看到自动注销功能是安全性的，这是否认为有必要采用无 JavaScript 后备方案？
如果是这样，我能看到的唯一解决方案就是存储 &比较连续请求的访问时间，但我已经看到的警告是；
- 它不再是“空闲”时间（用户实际上“离开”的时间），而只是每次页面加载之间的时间。
- 如果用户离开，当前页面上的任何内容都将无限期地受到攻击，直到下一个请求触发注销为止。
为了论证起见，我可以说服务器端解决方案可以在请求之间的 Z 小时后注销，而不是 JavaScript 的更短时间？
您对此事有何看法以及我提出的解决方案？
So I need to implement an auto-logout feature for WordPress. With JavaScript this seems straightforward;
- Prompt after X minutes idle (jQuery.nap), alternate
<title>to gain attention - If there is no confirmation after Y seconds, run logout
Seeing that the point of an auto-logout feature is security, would that deem it neccessary to have a no-JavaScript fallback?
And if so, the only solution I can see is to store & compare access times on successive requests, but the caveats I can already see are;
- It's no longer 'idle' time (time the user is effectively 'away'), merely time between each page load.
- If a user has walked away, whatever is currently on the page is vulnerable indefinitely, until the next request fires the logout.
I could say, for arguments sake, a server-side solution to log out after Z hours between requests, as opposed to a much shorter time for JavaScript?
What are your thoughts on the matter, and my proposed solution?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在我看来，使用 Javascript 来实现这一点充其量也是不稳定的。如果威胁是用户在登录时离开计算机，然后攻击者走上来并在他的帐户上做坏事，那么攻击者很可能在走近计算机时禁用 JavaScript。当然，除非攻击者到达那里时计时器已经到了。但这意味着计时器必须非常短。
我不了解你，但我讨厌几分钟后自动注销你的网站。在我看来，这是一个巨大的麻烦，但安全效益却微乎其微。对我来说，这似乎不是一个现实的威胁：有人跟踪您的一位用户，而该用户恰好在公共场所，使用一个重要帐户，然后离开，留下计算机无人看管？
更现实的威胁是，连接本身会被某人在没有实际注销或其他情况下退出浏览器的情况所劫持。服务器端超时可能一个小时会很有用。
Using Javascript for this seems precarious at best to me. If the threat is the user walking away from the computer while logged in, and then an attacker walking up and doing bad things on his account, then the attacker could very well just disable javascript upon walking up to the machine. Unless of course the timer has already hit by the time the attacker gets there. But that would mean the timer would have to be pretty short.
I don't know about you, but I HATE websites that automatically log you off in a couple of minutes. It's a huge hassle for very little security benefit, IMO. It just doesn't seem like a realistic threat to me: Someone following one of your users, who happens to be in a public space, using an important account, then walks away leaving the computer unguarded?
A more realistic threat would be that the connection itself gets hijacked from someone quitting out of the browser without actually logging off or something. Having a server-side timeout of maybe an hour would be useful there.