5 ms·
In short, you can't rely on the client doing _anything_, especially following the protocol correctly.
by alexchamberlain 3y ago
In short, you can't rely on the client doing _anything_, especially following the protocol correctly.
- paulgb 3y agoThe proposal says that server-side expiration is still required. The ability to request that the client delete the token when the computer is locked is purely additive; if the client does not honor it, at worst you just get something equivalent to the status quo with cookies. If the client works correctly, you get a security feature that is currently impossible with cookies (wiping the session as soon as the laptop lid closes, instead of some time after that.)
- maxloh 3y agoIt is possible currently. Just attach an `beforeunload` listener which asks the server to invalidate the current session.
- paulgb 3y agoI just tried it (Chrome on Mac), and beforeunload is not called when I lock the machine. The MDN docs also don't suggest that it should be.
- maxloh 3y agoFor the "invalidate session on screen lock" feature, it is possible to create close enough workarounds in today's JavaScript. https://stackoverflow.com/questions/15959244/ https://stackoverflow.com/questions/15959244/ Bottom line, you can simply listen to mouse move events and invalidate the current session on user inactivity.