when to delete user's session

Question

I'm writing a webapp that will only be used by authenticated users. Some temporary databases and log files will be created during each user session. I'd like to erase all these temp files when the session is finished.

Obviously, a logout or window close event would be sufficient to close the session, but in some cases the user may keep the browser open long after he's finished.

Another approach would be to time user sessions or delete the temp files during routine maintenance.

How do you go about it?

Answer 1

User sessions should have a timeout value and should be closed when the timeout expires or the user logs out. Log out is an obvious time to do this and the time out needs to be there in case the user navigates away from your application without logging out.

Answer 2

Delete User's Session during:

1) Logout

2) Automatic timeout (the length of the timeout can be set through the web.config)

3) As part of any other routine maintenance methods you already have running by deleting any session information which hasn't been accessed for some defined period of time (likely shorter than your automatic timeout length because if it was the same length it should already be taken care of)

Answer 3

A cron job to clean up any expired session data in the database is a good thing. Depending on how long your sessions last, and how big your database is, you might want to cleanup more often than once per day. But one cleanup pass per day is usually fine.