3rd party app in an iFrame must keep header/top frame session alive

Question

Page has a header and an iFrame. The iFrame has content from a 3rd party app. The 3rd party app is leaded from a different server than the page. The user will spend most of their time in the iFrame.

If the user spends most of their time in the iFrame the top page session will timeout.

What possible ways are there to prevent that? Is there a way to detect post back events in the iFrame and increment the timeout timer in the top page?

Any sample code is appreciated.

Thanks

Answer 1

I normally code with the assumption that, if I'm having to fight the framework and write in kludgy hacks, then I'm probably doing something wrong. Triggering post-back events on your parent page is exactly the sort of kludgy hack you should avoid.

I recommend tracking a users through cookies than sessions. If a user navigates to your page without a valid session, look for the cookie, and re-initiate the session if needed. Be sure you don't store sensitive, plaintext data in your cookie, because you don't want your site to be vulnerable to session hijacking.

Simple strategy like this eliminates the need to repeated ping your page.

Answer 2

You could add another, hidden IFrame on the main page that is set to refresh every 10 minutes (or whatever sits within the session timeout). This would cause the session on the main page to stay alive without the user experiencing any page refreshes.

EDIT to add requested example

        var frameHTML='';
    function CheckFrame() {
        //get frame BODY
        var frameBody=$("#FFRAMEID1" + _frameNumber).contents().find("body").html();

        //Compare
        if(frameBody==frameHTML) {
            //Content has not changed.  Do not refresh main session.
        }
        else {
            //Content has changed.  Refresh main session.
        }

        //Set most recent check string
        frameHTML=frameBody;

        //Set OTHER hidden frame source to refresh main page (could be replaced by just an AJAX call)
        $('#FRAMEID2').attr("src", 'FRAMESRC');
    }