autologout when browser closes

Autologout does not currently logout a user when the browser closes. It auto logs out a user when a timeout occurs.

> Autologout does not currently logout a user when the browser closes.
> It auto logs out a user when a timeout occurs.

1)
For a school website, to prevent malicious users using other's accounts, I require that if pupils forget to logout and just close the browser, that the session is ended by the website. Does anyone know if there is a way from Drupal to actually do this?

2)
What does 'timeout' actually mean in this case?
I am assuming that as soon as the user logs on, they have a fixed hour (or whatever) before the session is closed, even if they remain active the whole time and are still active when the hour is up? If so, what if the user was half-way through a post or upload when they got logged out; would they lose their work?

Also, what would happen if the timer was set for 1 hour, but after 30 mins the user closed the browser and left? Would the session still end after a fixed hour, or would the timer actually stop at 30mins until the user reconnected?

3)
For a school website, can anyone suggest any methods of lessening the chance of another pupil opening the website to find they are logged on as the last user, and posting maliciously?

Thanks.

For a school website, to prevent malicious users using other's accounts, I require that if pupils forget to logout and just close the browser, that the session is ended by the website. Does anyone know if there is a way from Drupal to actually do this?

One way to deal with this is set the home page (default) of the browser to http://www.example.com/logout . Then if there is an active session the user will be logged out and the session closed.

Looking at http://drupal.org/node/16217#comment-112793 I see they suggest this line in your settings.php

ini_set('session.cookie_lifetime',  2000000);

This says that the cookie should live for 2000000 seconds( just over 23days) after the page is loaded. If you change this to:

ini_set('session.cookie_lifetime',  0);

this will kill the cookie when the browser is closed, which in turn kills the session which will log out the user.

What does 'timeout' actually mean in this case?

Timeout means: account inactivity

I am assuming that as soon as the user logs on, they have a fixed hour (or whatever) before the session is closed, even if they remain active the whole time and are still active when the hour is up?

When the user logs on a timestamp is set in the session. When the page is reloaded or another page is requested, either by a user or by a force reload done according to settings the timestamp is checked. If the difference between the timestamp and the current time is greater then the timeout value the user is logged out. You can set the timeout to 15 minutes and when there is 15 minutes of inactivity, when another page is loaded the user is timed out, but if the users is active and continues to load pages from the site they will stay logged in.

If so, what if the user was half-way through a post or upload when they got logged out; would they lose their work?

There are two settings. Force reload when the time is up, or not. When the force reload is done the current page is reloaded, so anything they might be working on is lost.
When the force reload is disabled the user won't notice anything until they open another page or submit the current page. Automated Logout was designed to allow the submission of content before the user is logged out. Only is the page is not auto reloaded. When the user hits "submit" the form they were submitting is submitted and updated in the database, then the user is logged out.
Uploading a file is part of a form submission, the timeout occurring during the file upload should not cause any problems, the file should finish uploading, the the user would be logged out.

Also, what would happen if the timer was set for 1 hour, but after 30 minutes the user closed the browser and left? Would the session still end after a fixed hour, or would the timer actually stop at 30mins until the user reconnected?

If the user still had 30 minutes left in the session when the browser was closed the timer keeps on counting. If the browser is opened and navigated to the website before the timeout occurs the timeout is reset and the full time is allowed before timeout again.

add checkbox on automated logout settings page to enable cookie expire on browser close.

Awesome.
Thanks for your answers.
What a great module!

I have taken a look at this task and have decided that to implement the functionality you would need to hack Drupal core, it is best to implement in settings.php

> I have taken a look at this task and have decided that to implement the functionality
> you would need to hack Drupal core, it is best to implement in settings.php

The way you describe this module, it sounds like it works very intelligently.
I'm sure it will suit a school environment as it is.

Thanks for looking at this feature; the settings.php session time will probably suffice.

Cheers!