Unset Session When browser tab is closed

Question

Where user enters the website, it sent a default language, at the same time it will force the user to select a language from a list...
When user selects a language it sets a $_SESSION['language'] = $_POST['lg'];
At the same time I set another $_SESSION['sestime'] = time();
with this session I can do this:

if(isset($_SESSION['sestime']) && (time() - $_SESSION['sestime'] > 600)) {
session_unset(); session_destroy();
header("Location: $sred");
exit;
}
$_SESSION['sestime'] = time();

With that if there are no activity within 10min it destroy/delete/unset any session, the idea is to ask again for the lanaguage... now, this is "working", but what I'd like is away to "detect" when user is about to close a browser tab, the websites tab... if users close the tab then "destroy/delete/unset" any session for this website...
Is that possible?

You could have a periodic AJAX request with a lower timeout, but then you'll be making your site unusable for people who turn off Javascript or who have disabilities and use alternative technologies to browse the web. There is nothing in the HTTP protocol that lets you know when a user stops viewing your site, so your best bet is a sane timeout. — Ghedipunk

Nana Partykar Nana Partykar · Accepted Answer · 2015-10-08T17:14:34

Session Cookies are usually sent without an expire time which means they are deleted when the browser is closed, so the session is lost anyway.

1) Destroy or unset session when user close the browser without clicking on logout

You can set an expiration time for the session data, test it with each session_start call and destroy the session if it’s expired:

session_start();
if (!isset($_SESSION['EXPIRES']) || $_SESSION['EXPIRES'] < time()+3600) {
    session_destroy();
    $_SESSION = array();
}
$_SESSION['EXPIRES'] = time() + 3600;

2) destroy session when broswer tab closed

implement a session timeout with own method. Use a simple time stamp that denotes the time of the last request and update it with every request:

You need to code something similar to this

if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 1800)) {
    // request 30 minates ago
    session_destroy();
    session_unset();
}
$_SESSION['LAST_ACTIVITY'] = time(); // update last activity time

3) How to change the session timeout in PHP?

session_start(); // ready to go!

$now = time();
if (isset($_SESSION['discard_after']) && $now > $_SESSION['discard_after']) {
    // this session has worn out its welcome; kill it and start a brand new one
    session_unset();
    session_destroy();
    session_start();
}

// either new or old, it should live at most for another hour
$_SESSION['discard_after'] = $now + 3600;

4) The unload event is sent to the window element when the user navigates away from the page. This could mean one of many things. The user could have clicked on a link to leave the page, or typed in a new URL in the address bar. The forward and back buttons will trigger the event. Closing the browser window will cause the event to be triggered. Even a page reload will first create an unload event.

$( window ).unload(function() {
  //use ajax to call another page to session_destroy();
});

Question is: What if the user has two or more tabs open on your site? If they close one tab, the other one would effectively be logged out.

Unset Session When browser tab is closed

2 Answers